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Date of transcription |. 09/21/2015 


Platte River Networks, date of birth bé 
social security number was Interviewed b of BIC 
Investigation (FBD Special Agent (SA) and SA Also present 


for the interview was Department of Justice (DOJ) Attorney 
attorney at the being advised of the identity of the interviewing agents and the ` 
nature of the interview provided the following: ; 


umesue)a|] <  } described his role at PRN as a 
general role with the client and not involved with technical details. ain concern 1s the - S 


general direction of the business. 







U/FOU6) On September 14, 2015 






(U//FOO) Platte River Networks (PRN) worked with an individual ud eun, bé 
identify business opportunities. In early 2013 brought them a client opportunity who she claimed STE 
once worked as a public official. After submitting a bid to do the work, PRN became aware the contract 

they were bidding on was for the management of an email server hosting domains associated with BILL 
CLINTON, HILLARY CLINTON and their aides. PRN won the bid for the contract and the account was 

under the name CESC. 


(U//EG3O0) PRN wanted to limit the employees working on the CESC server, so it was 
wu et who worked remotely on the server, an who bé 
handled the server on-site, would be the technical team doing most of the work. as aware ST 
that PRN picked up an old server from the CLINTON residence and delivered it to Equinix, a datacenter 
in Secaucus, New Jersey. PRN ordered and installed new server hardware at Equinix and migrated all 
CESC email from their old server to the new PRN provided wel e aware that PRN 
maintained a back-up of the server known as a DATTO. The DATTO was located at Equinix and worked 
by taking snapshots of the server and maintaining tha 0 days before it was deleted. __ 
CG ben t or specifics as also aware of a BlackBerry 
Enterprise Server managed by , but deferred to on the specifics. 


(U/F6¢6) In or around March 201 d was involved in conversations with CESC i 


Te uested to know what email they had, where it was, and how it was backed up. SES 
and — — — ] handled this request and would know more details. CESC never asked 
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for administrator rights to the PRN server or for physical access to the server at Equinix. 


believed CESC was still a PRN client and were operating under the same contract they originally signed. 


(UFOO) 
CESC email server 


[L it" believe there was a successful intrusion attempt against the 
run by ; 
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(U/#OUO)On May23,2016| ž |daeofbinh| social 


security numbe was interviewed by Federal Bureau of Investigation (FBI) Special Agent 


and S at the offices of Platte River Networks (PRN) located at 
5700 Washington Street, Denver, Colorado 80216. Also present for the interview a 
and via speaker Gg aa | —LAfter being advised of 
the identity of the interviewing agents and the nature of the interview ` 
following information: 








provided the 





(U//FOUG) [vas not aware of a laptop wa an archive of email belonging to 


HILLARY CLINTON that was shipped to PRN around February 2014. was not aware 
what became of the foregoing laptop. 


meane rend recently was made aware of a CLINTON email archive file being 
ited to the Clinton Executive Services Corporation (CESC) around July 2014 and September 2014 


b ed /—  . .  ]was not aware of the request by CESC, or transmittal by 


_} as it was occurring ] vas not aware of what specifically was requested by 


rr fulfilled the request. 









October 2014 to January 2015 f any CESC request to delete, wipe or 
shred their email records. As would not pay attention to 
technical details of any PRN client. 


(U//FOUO) At this point in the interview, Agents displayed PRN provided records and email from 
the March 2015 imetama —— | provided the following information: 


(U//FG9O) In March 2015, when various media outlets reported a private email domain and 
server was used by HILLARY CLINTON, PRN decided to create an internal “share drive” and control 
access to only the PRN employees working the CESC account. stated PRN did have back- 
ups of their own servers. PRN never deleted information pertaining to the CESC client and provided the 
FBI all records they maintained pertaining to CESC. 
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(U//FKOQUO) In March 2015 stated CESC — an inventory of all their email 


content, to include where it existed. PRN employee travelled to the Equinix 


data center in Secuacus, New Jersey where the CESC server equipment was located| — Jun 
not a party t j ion involving CESC’ inventory, therefore did not know specific 
instructions id not recall wha pecifically found on the server equipment. 


discussed preservation of materials, ould not recall any other request by any entity to 


(U//FOJO) After Agents "- an email dated March 09, 2015 where CHERYL MILLS 
preserve CESC related data. 


(U//FOBO) no recollection of a conference call on March 25, 2015 or March 
31, 2015 with CESC. ted CESC never requested their email content by deleted, wiped 
or shredded. Recently, as made aware au ` `` ` eg Bleachbit software to 
shred .pst email files containing CESC email content that was transferred to CESC. As 
understood it reated a “vehicle” to transfer email files from the live mailboxes of CESC 
email accounts en later used Bleachbit software to shred the “vehicle” but the email 


content stil] existed in the live email accounts. 


(uresel]  J]was unaware of any PRN employee conducting manual deletions of 
the DATTO device used to back-up the CESC email server. 


(uree ]wa unaware of any successful computer intrusion of the CESC server. 


(U//FO8O? Notes of the interview and documents displayed vd win be maintained 
m a FD340 envelope and filed with the captioned investigation. 
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date of birth (DOB) — ———— and = 
Federal Bureau of I - 
at the law offices o 






(U/PORO) On April 19, 2016 


social security account number (SSAN 
so present for the interview were 


FBI) Special Agents (SA an 
ocated a Washington DC | 
attorneys mÁ After being advised of the identity of the 


interviewing Agents, and the nature of the interview provided the following information: 


is currently ————— t 
met President WILLIAM Alert. B — mt when he became an 


t the White House in the fall o After hi served in various positions in 
the CLINTON White House and continued to work for President CLINTON after his presidency. 
















(U//FOHO) In the years after President CLINTON left the White House, CLINTON’s staff 
managed certain details related to the information technology needs of CLINTON’s office. One of those 


needs required negotiating with an individual who owned several .com domains related to CLINTON's 
amel lees these domains to be presidentclinton.com, clintonfoundation.com, and owjc.com. 


Ultimately, negotiations were successful and the domains were purchased from the individual. 


b6 
b7C 


(UFOS) In 2006 or 2007, JUSTIN COOPER obtained a private email server (Apple Server) 
for the office of President CLINTON. COOPER an had several conversations about reliability 
issues related to the previous outsourced server and decided it would be best to have a server under their 


physical control at the CLINTON's residence in New York. COOPER handled the procurement and all 
ts or any requests to move email. Ee 


| and 

| initially had email accounts on the Apple Server. NENNEN ecalled a conversation PS 
with HUMA ABEDIN and COOPER regarding the addition of HILLAR Y CLINTON to the A | 
Server. L. 3 thought it was a bad idea, but the issue had been decided by that point in time. ed 

believed the addition of HILLARY CLINTON to the Apple Server occurred while she was in the Senate. 
CLINTON used BlackBerry devices obtained by COOPER to access her uui] Das not involved 
in the decision to move to a new server (Exchange Server), but recalled it was located, as was the Apple 
Server, in the basement of the CLINTON’s New York residence. 


aspe of serve manacement, fc de the creation of new acco 


b3 
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Investigation on 04/19/2016 ecw tht Washington, DC 


rect [Jn = 20. eegenen uA | 8 


ppe 
By SA : b6 
: Bic 


This document contains neither recommendations nor conclusions of the FBI lis the property of the FBI and is loaned to your agency; il ` 
and its contents are not to be distributed outside your agency. | 


UNCLASSIFIED //rose 


*"  UNCLASSIFIED//£686 


FD-302a (Rev. 10-6-95) 





Continuation of FD-302 of Interview of Justin Gregory Cooper B , On 03/02/2016 , Page 2 


system, bu ould not recall any specific details. They shared a mutual conce 
had too much private information about the CLINTONS and may have had access to some of their 


communications. 
(U//FOUO) [ had no knowledge regarding the following topics: 


e discussions to move to the Exchange Server 

e personnel involved in the decision to move to the Eeka Server 

e domains on the Apple Server or Exchange Server 

e users on the Exchange Server | 

e disposition of the Apple Server or Exchange Server after decommissioning 

e classified information on Apple Server or Exchange Server 

e conversations concerning federal records as it related to the Apple Server or SE Server 
e backups of the Apple Server or Exchange Server 


e Sensitive Compartmented Information Facilities at the CLINTON’s New York or Washington, 


. DC residences | Jia recall Secure Telephone Units in New York and Washington, DC) 
e Secure fax machines or secure computers at the New York or Washington, DC residences 
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ee Yost a notified | few times each year about attempted intrusions of the 
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Date of transcription 06/09/2016 
(U/FOUO)OnJune6,2016| — —  ]dateofbirth 
social security number was interviewed by Federal Bureau of Investigation ( pecial 
Agent (SA) and uw 0 ee at the FBI Washington Field Office, 601 b6 
4" Street NW, Washington, DC 20535. Also present for the interview was FBI Intelligence Analyst b7C 


being advised of the identities of the interviewing agents and the purpose of the 
interview, provided the following information: 


ls. Mete for 


has several products to incl 
from the over 60 billion records i | 
Inc. (DHD), a company owned by former Deputy Under Secretary of Defense for Intelligence 


REGINALD HYDE. DHD works with foreign data, can contract directly with the government, and 
frequently embeds its personnel with clients. 


(U/F EUG} In June or July 2015 O essi a senior staff member of the United 
States Senate Committee on the Judiciary, contacted | Lb it of concerns data from HILLARY 














b6 
b7C 






bé 
b7C 







was an intrusion into CLINTON's server and, if so, whether exfiltrated data fell into the hands of a 
foreign power. was concerned any exfiltrated data could endanger her three sons, who are 
Marines. | as a citizen and Senate Staff Member that this situation could occur. 
Therefore, if it was possible to determine if CLINTON’s server had been 


compromised.| _ stated he would have to look for data that was genuine, authentic, and relevant. 
| [defined ose three terms as follows: 


- Genuine — data originating from-CLINTON's server 

- Authentic — data that had not been altered 

- Relevant — data from CLINTON’s server that was moved outside of the United States to a place 
where a foreign actor could access it 


(U/FOY9) Since| Kn not have funding for the 
September 2015 she met with NEWT GINGRICH and asked 


oroject described above, in August or be 
[14 to brief GINGRICH on the project. — P7€ 
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GINGRICH, and| __] were all bothered by the potential that data from CLINTON’s 


server had been compromised. wanted t ers about the project and j 
December 2015, recommende speak with at Judicial Watch. [briefed 


the project as four phases to The phases were to determine if: 


- Phase 1 -CLINTON’s server was directly or indirectly attacked 

- Phase 2-SIDNEY BLUMENTHAL’s server was directly or indirectly attacked 
- Phase 3 — data was exfiltrated outside the United States 

- Phase 4 - data was exposed to a foreign actor 


Ad] | briefed the project, he raised the question of what the course of action would be if classified 
information was uncovered. The three discussed it and decided Judicial Watch's legal counsel should be 
consulted. never received an answer, but was of the opinion that if he uncovered data he 
thought might be classified, he would be obligated to report it to the appropriate authorities. 


(UFO In January or February 2016, Judicial Watch’s legal counsel advised the project was 
feasible, but could not involve accessing any systems without authorization. The project could review 
open source data following the four phases described above. After these initial discussions with Judicial 
W atc concluded the motivation of Judicial Watch's actions was not centered on the elections. 


(UFOS | advised there are three potential funding streams for the types of projects 
his company undertakes. They can be funded by his company, a government contract, or a data 
arbitrageur. In this situation, the arbitrageur would invest in litigation on the prospect of a judge awarding 
the arbitrageur attorney’s fees. | 


(U//FOU6) In February or March 2016] — Lompany|, — was given $32,000 by Judicial 
Watch to proceed with Phase 1. Judicial Watch awarded the contract t becaus 
confident he understood both the Deep Web and Dark Web. After receiving the CMT to 
determine the best place to obtain the necessary data for the project. Based on the terms outlined by 
Judicial Watch's counse mM eee respective servers were off limits, as were 


offshore servers. turned t a former executive at a cyber intelligence 
company which m data from the Deep Web and Dark Web and, then, indexes the data. By 


leveragin da could search the Deep Web and Dark Web without exposing his 
searches to the Int pai $2,500 to havel |conduct searches based on search 
terms provided b These search terms included, but were not limited to, HILLARY 


CLINTON Y BLUMENTAL, and an Internet Protocol (IP) address range obtained from an email 
| t y Judicial Watch. In return, ided the results of those searches to 
which was the exclusive data source use or this project. 
(uiFeve]  þeviewed the data provided b d found files from 
BLUMENTHAL’s server on a server in Romania. believed BLUMENTHAL had a personal 


UNCLASSIFIED/ -Feve 


p6 
b7C 


b6 
b7C 


b6 
b7C 


b6 
b7C 


b7C 


b6 
b7C 


b6 
b7C 


UNCLASSIFIED / /Fese- 


FD-302a (Rev. 10-6-95) 


Continuation of FD-3020f____Interviewof[ sid On 0606/2016, Page 3 


server because he found some of BLUMENTHAL’; files on the server in Romania, but not any of 
BLUMENTHAL's emails. The Romanian server contained approximately 200 Microsoft Word, Excel, 
and other file types belonging to BLUMENTHAL. 


(U//FOUO) In reference to a May 22, 2009 alleged intrusion of CLINTON'S server appearing in a 
draft version of a report o proj sl `" ` e he could not recall where he learned of the 
hack or the specific date. peculated it was possibly from a public report, but he had looked for 
the source and could not find it. Therefore, planned to remove the reference from future 
iterations of the report. 


(U//FOUO) During k review of the data obtained by € found one sensitive 
Excel file listing the names of known or suspected jihadists in Libya. added that a portion of the 


file was in Russian. The file did not come from BLUMENTHAL’s server, but contained a r nce to an 
IP address range that included the IP address of CLINTON's server. Upon viewing this file 

became con ad found a classified document and stopped the project. This work completed 
Phase |] ed Kiem to deliver the final report to Judicial Watch soon. 


(vU/Fose)| [stated some of the BLUMENTHAL files were dat out January 
2012, which was the same timeframe whe contacted regarding the 
Libyan Rogue Nation Judgment Recovery Program (LRNJRP). laimed he was hired 


ibyan opposition government to recover the assets of the MUAMMAR GADDAFI government. 
also met with TYLER DRUMHELLER regarding the same matter. speculated 
BLUMENTHAL, if involved in the LRNJRP, could have written the memos as a “shake and bake” tactic. 


(U//FOGUQO) A copy of the original interview notes and documents provided to the FBI sy | 
during the interview are enclosed in a 1A envelope. 
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On September ia, 2013[.— Jane bie — 2. 
Networks (PRN), date of birth) — [social security number — — . — |wasinterviewed by 


Federal au of Investigation (FBI) Special Agent (SA po Lo and SA D mn) 
Also present for the intervyg à i O U fro EEN O nd 


partment of Justice (DOJ) Attomey C r:a: ino advised of the identity of the 
interviewing agents and the nature of the interview, provided the following: 


On or about January md sees O egarding 
potential business with a high profile former government client. had an existing 


relationship with cause she previously referred other clients from a family wealth asset 
management firm. The potential client’s current email server architecture lost connectiv) 
such as Hurricane Sandy, so they wanted better support than their existing arrangeme 
with the assistance of other PRN personnel, put together a proposal and submitted it 
PRN was chosen as one of the three finalists for the contract, PRN was notified the potential client was bE 
WILLIAM CLINTON and HI M EEN doing business pany named CESC. b7c 
RN won the contracti c on a smaller role anc lwarked primarily with . | 
CESC wanted to keep the number of individuals 

: identifi ied three people as the only personnel alowed to work - 
directly on the CESC proie hose individuals were identified jin a Servi ' 
signed in August 2013 as | (solution de sien) —  — —— ] project 
manager). anc i(help desk). did approximately 90% of the work for CESC 
and) sid andled approximately 10% of the work. ole was to help with on-site 
work at Equinix, whil 4 handled everything else. Pd was ultimately not needed to 
work on the project. 









— 














| j e $ ME b6 
3 asked to revie il he sent discussing a new email address for 57C 
| | {rout not answer the question for attomey-client 
privilege reasons. A copy of the email is attached to this communication in an FD-340. 


PRN chose Equinix as the datacenter for CESC's new email server (hereafter, PRN server) 
it did not go down during Hurricane Sandy. This project was PRN's first time using 









Y ; b6 
Equinix ransported CESC's existing equipment (hereafter, predecessor server) and b7c 
transported 1 uinix, so the content of the predecessor server could be migrated to the new PRN 
server 
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interviewof LI | On 0914/2015 , Page 2 — 
stated PRN used an outside firm, MX Logic, for spam filtering, but referred other 


| fa no knowledge of: 


e Email servers used by CESC prior to the one transported by PRN to Equinix. 
e The existence of classified information on either server. ` 

e Discussions regarding federal records retention. 

e Intrusions to the PRN server. 
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n May 23, 2016 date of bi social security 


O { date of birt] | 
web was ederal Bureau of Investigation (FBI) Special Agent (SA) 

and a at the offices of Platte River Netwo at 5700 
Washington S lew mm Semer via 
speaker phone ing advised of the 
identity of the interviewing agents and the nature of the interview rovided the following 


information: 


(eBo rr for PRN, and in tat roe 
had contact with PRN chent CLINTON EX CO ). His points 
of contact at CESC were CHERYL wus] |] nd | 

(U//FOUO was not aware of a laptop containin mail belonging to 
HILLARY CLINT at was shipped to PRN around February AË hwas not aware 
what became of the foregoing laptop. 







(U/FOUO as not aware of a CLINTON email archive being transmitted to the 
Clinton Executive Services Corporation (CESC) around July 2014 and September 2014 b 


(U//FOUO 
October 2014 to January 201 5. 
shred their email records. 


(U//FG8O) At this pointi i iew, Agents displayed PRN provided records and email from 
the March 2015 timeframe provided the following information: 


(U//F909) In March 2015, when various media outlets reported a private email domain and 
server used by HILLARY CLINTON of hiring a any 
recommende 


to conduct penetration t i WË 
from a company named but the testing ultimately did not occur. 


e of any support PRN provided the CESC client from 
was not aware of any CESC request to delete, wipe or 
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(U//FOUO) In March 2015, recalled PRN employe avelled 
to the Equinix data center, but did not know the purpose of the trip. 


(U//FOQU€9 After Agents displ email dated March 09, 2015 where CHERYL MILLS 
discussed preservation of materi could not recall any other request by any entity to 
preserve CESC related da recalled receiving some guidance by PRN attorneys to 


preserve data, but could not recall specifically. 






(U//FOUO d no recollection of a specific conference call on March 25, 2015 or 
March 31, 2015 with CE id recall conference calls with CESC that were run by 
PRN's attorney. stated CESC never requested their email content by deleted, wiped or 


shredded. 


(umege| was unaware of any successful computer intrusion of the CESC 


(U//FO'8O3 Notes of the interview and documents displayed t| [will be maintained 


in a FD340 envelope and filed with the captioned investigation. 
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| (U//F&GHO) On February 4, 2016 home addres 
| Ma mobile phon was interviewed at the law offices of Bryan Cave LLP, 1155 F 
treet Washington 20004 ederal Bureau of Investigation (FBD Special Agent ( b6 
d SA Department of Justice vu EE ` SI 
~ counsel, ere also present for the interview. After being advised of the identity of 
the interviewing agents and the nature of the interview| |provided the following: 


. (u/FeSe  ]firstmet President WILLIAM CLINTON and HILLARY CLINTON. ` hs 
CLINTON) in 1997 when he was assigned fo The White House a| |] At that time, s 


received a security clearance after a single scope background investigation was conducted. He 
served in The White House o include traveling with the Pres:dent, until 2001 when President 


offi President CLINTON’ 


told ¢ CLINTONSs had been keeping an eve on him and would like him to join 
accepted the offer and "— X | drove to their Chappaqua, 










their New York family. 
NY residence. For the first six months]  , — [position was covered as part of the militarv assistar 
provided to every president who leaves office 


He then returned to Chappaqua where | 
he primarily focused on | but ended up with many more responsibilities. 


(U// setze! ` recalled an Apple server in the basement-of the CLINTON’s Chappaqua SR 
oes not remember when it was installed or by whom. It was a big box to the right of BIS 
with no external devices attached, however, it had an internal capability to backup data. 

A ABEDIN, HILLARY CLINTON, J T Ne AND 


ad email accounts under the owjc domain housed on the server. also used the 
server.as a workstation. | | 


(u/reue) ^ Jtidnotknow of plans to install the server constructed by BRYAN b6 


[^ at the time it occurred. The server consisted of three thin black boxes mounted in a rack. ST 


escribed himself as not technical and, therefore, could not speak to any details regarding this 
Server. | i 
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(UFOO) did not recall escorting anyone from Platte River Networks in June 2013 b6 
into the Chappaqua residence to remove the Server described above. SZ 
(U/FOUO) HILLARY CLINTON's office was on the third floor of the Chappaqua residence. 
After she became the Secretary of State, the State Department (State) converted it into a sensitive | 
nted information facility (SCIF). During the installation of the secure lines for the SCIF, r 
tood at the door as-an escort for the technicians. After that conversion, CLINTON was the E 


only one who had the combination to access the office until it was decommissioned one to two weeks 
after her departure from State. It contained approximately three phones installed by State. 


believed all ecure phones and described them as a black STU phone, a yellow phone, and a 
white phone. id not know the differences in the phones. The office al tained 
CLINTON’s non-secure desktop computer, a shredder, and a secure fax machine| initially 


stated he only entered the SCIF once or twice, when CLINTON was present, to remove trash. 


| | : | b6 
(gene ` ` aerrecalled a procedure established by ABEDIN wit] — — hte —— PS 


beginning ON's tenure at State for situations when CLINTON needed assistance. with the secure 
fax. Whe was notified by State personnel of an incoming secure fax, he would locate 
CLINTON, follow her to the SCIF, and assist as needed with the incoming fax. He was never in the SCIF 
to receive a fax without CLINTON present and never physically picked up any of the documents 

received. If the fax was not working, State would sometimes send a ier with documents or a 
‘diplomatic pouch to the Chappaqua residence. On those Eens escort the courier 
mmm to the door and the courier would hand the documents or pouch directly to CLINTON. 


ould also coordinate the repair of the fax when broken. 


(U//F89O) ABEDIN or CHERYL MILES would sometimes omg! Jee Presidential Be 
Datly Brief (PDB) would be coming via secure fax to the residence. As described above with other SUV 
secure fares oul locate CLINTON a ist with the incoming secure fax. The PDB was 
also hand carried to the residence on occasion el "` keeft escort the courier to CLINTON. 

(UFO iodically received emails from ABEDIN with attached documents Sn 
intended for CLINTON. would print the documents and give them to CLINTON, but does not 
know what happened to the documents after CLINTON was finished with them. Last Name 


Unknown handled similar duties at CLINTON’s residence in Washington, DC. 


(UFOS CLINTON had several BlackBerry devices over the course of time. When 


had issues with one of them, would ask COOPER for advice on how to fix it. b6 
elieved CLINTON had a State BlackBerry, but did not recall a secure mobile phone. | DIC 

U//FOUO did not recall setti Apple ID or iPad for CLINTON. | BS 
( fo] id not recall setting up an Apple ID or iPad for CLINT T. 

(uFese) pid not recall a secure phone in CLINTON's bedroom. Lë 
| | | ' b7C 
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LATE LO-O05-2014 By J27795T34 HSICC 


b6 
b7C 
and his email address is was advised that 
the FBI had identified 37 login attempts to the APPLE ICLOUD account 
of hdr22@clj mail.com, originating from three -owned IP- 
addresses. was provided with the IP addresses at made the 
login attempts. After being advised of the identities_of th 
interviewing Agents and the nature of SS interview,| | provided 
the following information: 
P roximately [| _Jemployees at their main | 
headquarte LE? in other b4 
locations. b6 
b7C 
has a large customer base 
including mag overnment adencies and Department of Defense 
components. bs 
| | M Provided the Agents with a demonstration of the | 
ot a laptop in his office.| Ù 
mt Lh 
Others. That data is then 
b7C 
| | ]eroviaes their clients with two basic services: 1) their 
security platform can be used to link and search for current social b6 
media information on the Internet; and 2) can provide on-going PC 
Social media monitoring for their clients. explained that the ORE 
b6 
b7C 
investigation on (03/23/2016 at 
File # CYBER “ÍY __ Date dictated __N/A es 
| dr 
By § 
This document contains neither recommendations nor conclusions of the FBI. Jt is the property of the FBI and is loancd: ta your agency. it b6 
and its contents are not to be distributed outside your agency, b7C 


b6 
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monitoring service to gener lerts for new Social media posts  . bE 
relating to current Additionally, provides that b7c 
same service for all United States Department of Commerce employees, DIE 


whether they are aware of it or not. 


with searchin 





bå 
bé 
b7C 
confirmed that two of the three IP addresses shown to him 
belong to | | ]statea that the third IP address may have 
been assigned tc em ir 2 D D that it was no longer active. 54 
The| Lis assigned to a 
b7C 
does not maintain istorical loc or searche hat are 
conducted by thelr clients. 
b4 
b6 
b7C 


then showed the Agents a screen on his laptop, where the username 
Field was displayed without a corresponding password field. 


To the best of| | recollectio as not hired by SS, 
HILLARY CLINTON or anyone on her behalf. ttributed the login 


to being ed by one of their clients, utilizing. the 
platform. hen ieft the interview for a brief moment in 


order to verify that was not conducting any continuous 
monitoring services for HIL TON. When he returned, 
confirmed that they are not. stated that he had a co-worker of 


his search for CLINTON's name within their platform. In order to 
protect the FBI's inquiry at had the co-worker search 
for CLINTON's name in the system, along with the names of two 


additional current Presidential candidates. The results were.negative 
on all three searches. 
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was then informed that the hdr22@clintonemail.com email 
account was LS in a NEW YORK TIMES article on March 02, 2015, 
and that the login attempts occurred on the foliowing day. 
| tated that this made sense to him. Given that information, he 
theorized that the login attempts were iikely made by one of their 
"good guy" clients, possibly to conduct a damage assessment on the 
Social media footprint associated with that email add ever, 
[stated that he could not verify his theory, ml Tie no 
additional data to corroborate it. 


| ass amenable to future contact with the FBI. 


b6 
p7C 


D6 
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telephone number is 
his email address is Also present for 
this interview was FBI 5A as advised 
nature of the interview was to determine whether or not 
mm Thad performed any penetration testing on the ` 
clintonemail.com domain. After being advised of the identity of the 


interviewing Agents and the nature of the interview, | _] provided the 
following information: | 


| | A ]aia not perform any penetration testing for the 


clintonemail.com domain. recalled that the clintonemail.com domain 
was previously hosted at the PLATTE RIVER NETWORKS (PRN) Internet 

in Denver, Colorado. is qood friends with 
who 1s 













at PRN. recalled speaking wit Oing 
penetration testing on that domain, approximately six months prior the 
large media coverage of the private server. provided security 


recommendations for the system; however, actual penetration testing 
did not ultimately occur. 


maintains a working business relationship with 
PRN. If a PRN customer wishes to have penetration testin erformed on 
their network, P | n refer that customer to 
Correspondingly, will refer their customers 
wish to harden their network systems subsequent to a 
Ae testing assessment. Lae 
leverages technical resources at PRN for other projects, including 


incident handling and forensic analysis. The two companies compensate 
one another with commission checks. 










Investigation on. — 04/12/2016 a Kolorado 
File # | L CYBER -Ll  Dacditaed — N/A ` 
By sa| | 
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b7C 
|  ]reca11ea sharing se emails with PRN employees regarding b6 
the clintonemail.com dese eani dealt with but  , Si 
remembered that there were a couple of other PRN employees included on 
the exchanges. jets n went to his office and printed out several 
email between him and Those printouts are enclosed for the 
file in a physical 1A envelope. 
never had access to the clintonemail.com domain, b6 
nor do th any of their company services on PRN networks. The 2d 
extent | S iaci with PRN employees, related penetration 


testing, and the clintonemail.com domain are documented in the email 
exchanges that| [provided during this interview. 


While reviewing the emails provided by| |] SA identified b6 
| public news articie, where an individual named ane 
had utilized a scanning tool called FIERCE to 
identify the addresses used for HILLARY CLINTON's (CLINTON's ersonal 

ovided that the referenced 
provided that 

managed an Internet oq where he posted new hacks and exploits on 
almost a daily basis. A few years ago, however, went dark and 


disc publishing his findj the Interne provided 
that goes by the name ot| ——————— euch 


e hacking 
community. 

























The two of them share b6 
b7C 


has known for several years. 
a passion for music. recalled that 
business that put on large- 
of a Madonna-sized concert. 
f | |. common bond. Additionally 
a blimp company that provided aerial 

coverage over large public events. 







ecalled meetinq |at a Colorado technical event, Be 
which referred to the event as a leads SZ 
event, which was a technical expo in Colorado where information 
technology experts could exchange ideas and ` } ith one another. 








During that event, spoke on a panel with and a US 
SECRET SERVICE Agent, named During introductions with one 
lor to the event, ecalled USSS SA Stating to 
that he had recently served a warrant at PRN. surmised 


that statement to relate to the on-going investigation_¢ -INTON’s 
email server. Agent Note: A follow-up call to USSS SA identified 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of amevewo| OO OOOO O O On 04/12/2016, Page 2 b6 


p7C 


warrant referenced in that conversation was served in support of 
different matter. 


as a “good guy”, who is caught in a bad b6 
M omm ER his frustrations ed _ ]regarains the b7C 
CLINTON email investigation. stated that it has had a 
direct impact on PRN's business, and that they have spent a large 

oney in legal fees related to the matter. Primarily, 
NEMENE ^ concerned over the negative publicity that PRN has 
received in the news media. Additionally, PRN has been asked to step 


out of certain requests for proposals (RFP's) as a result of the 
investigation. 


In additi | ac imi int j b6 
b7C 





However, 


When asked whether or not utilizes the[ | b6 
social media cyber security product, tated that they do not. BTC 


| fs amenable to future contact with the FBI. b6 
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6 
date of birth (DOB} [id was ae 
interv] | : LL Bur | i (FBI) Special Agents 
(SA) and at the law offices of 
DAY PITN Iocated at One Canterbury Green, Stamfor | O 
resent for the interview were DAY PITNEY im, | a 
[| After being advised of the identity of th 
erviewing Agents, and the nature of the bns oae 


the following information: 


b6 
DATT ocated at I01 Merritt 7, Norwalk, CT_O685i1, and ba: = the 


position for ior to that, was 
and worked partly as the 





DATTO is a company that provides products and services to small 
businesses related to cloud storage and disaster recovery. DATTO had 
an established relationship with PLATTE RIVER NETWORKS (PRN) and 
provided them server back-up and recovery services for some time. 
DATTO’s relationship with PRN was already established in 2013 when PRN 
acquired a new contract to manage an email server with a client known 
to DATTO as CESC. At the time, DATTO did not know who PRN's client 
CESC was. | 


When PRN reached out to DATTO in,May 2013 to provide back-up 
services for the CESC client server, PRN requested a slightly 
different service from DATTO than they normally request. Typically, 
PRN would request that DATTO back-up remotely to DATTO's secure cloud. 
For the CESC client server, PRN requested that the server be backed-up 


Investigation on — [1/19/2015 at Stamford, CT | 
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locally and privately. At the time of this request, it was not only a 
new request for PRN, but a non-standard process for DATTO. In order to 
affect the private, local storage needs for PRN's CESC client, PRN 
ordered a SIRIS 2000 device from DATTO, but forgot, or did not know, 
to also order the private node that the data would be routed to and 
Stored on. Because of this, the default on the DATTO configured SIRIS 
2000 sent the CESC server back-up data remotely to DATTO's secure 
cloud and not to a local private node. This default configuration on 
the SIRIS 2000 has since been changed. 







Stated that PRN must have known data was being logged in 
re cloud and not on a local private node. As evidence, 
stated the partner portal, that PRN had log-in credentials to, 


feature displaying backed-up data and options to delete cloud or 
delete local. [ stated_PRN would have seen their back-ups under 


delete cloud. jcrionally, | was shown a document provided by bé 
DATTO indicating email records were manually deleted from the TT b7C 
secure cloud back-ups of the PRN CESC server in March 2015. 


stated that it couldn't have been a DATTO employee that deleted those 
email records, because there would have been a work ticket indicating 


as much. Concer the IP address associated with the March 2C15 T 
deletions, | fthought was the DATTO relay server 
handl3 the connection | li a local host connection. 
states PRN had log-in credentials on the partner portal that 
€ 


At tied to one employee, so he did not know who from PRN logged 
in at any given time. | | 


Data 1s sent to the DATTO cloud through Secure File Transfer 
Protocol (SFTP) from the local DATTO device purchased by the client. 
Multiple DATTO devices, for different.clients, are synced to one node 
for unified data storage. Each DATTO device is segmented on that node 
and only writes to a directory paired. with the corresponding device. 
The data on the servers is partially encrypted and a password would be 
needed to access remotely. 


The DATTO server farm is housed in Pennsylvania, multiple levels 
underground, in a secure facility. In order to access the facility, 
you must be a client there and process through security, which 
includes a biometrics scan. The cages that house the servers are also 
locked. D 


FD-302a (Rev. 10-6-95) 


' b6 
Continuation of FD-302 of Interview oil | . On 09/02/2015 . Paze 3 H7C 


DATTO virtualizes systems locally on the DATTO appliance or 
remotely in the DATTO secure cloud. As part of this process, an 
automatic test is conducted to verify the virtualization where 
screenshots of the windows login screen are sent to DATTO clients. 
Many of DATTO’s clients, to include PRN, would occasionally get 
“packup verification failure” notices showing their DATTO device was b6 
unbootable. indicated this notice occurred very frequently and b7C 
almost always was an issue involving the virtual environment and not 
DATTO actually failing to maintain back-ups of the associated servers. 
This issue was usually resolved with a handful of solutions to include 
changing drivers and controllers or lengthening windows for 
verification. 


DATTO never altered or configured the retention settings 
regarding the period of time or frequency that the PRN server was 
backed up. The retention settings are set by the client. 


On 08/13/2015, after the CESC client was known to DATTO and 
lawyers became involved regarding the retention, preservation and 
production of records regarding the CESC client, DATTO shipped a new 
SIRIS 2000 device to PRN, The impetus.to the shipment was the 
realization that the SIRIS device Gees purchased by PRN was not 


encrypted. The provision of the new 5 as initiated by,' p6 
DATTO and brokered by their attorney, DATTO provided the GEI 
device to have increased security while also ensuring continuity of 
operation on. the server. / 
| b6 

stated the DATTO secure cloud is frequently scanned and b7C 
he has no.knowledge of any intrusion or deep penetration of their 
systems. stated the best place to look for network intrusion 
is the system Joes, 

b6 


EN... discussed federal records retention or classified p7C 
info fon with any representative of PRN or CESC. 
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5 been employed in the Records 
7 Ehe past PORE Ga 


Approximately 6 weeks ago, [| received an email fyr eow| | 


Ges x ^ NC 4 E Ns UE Së d D 

of tha Denartuent of State {SATE} Frecdom of Information Bot 55 
AMENS zw TE 

POTA) msectios. 





The. 








z 1 

s 

mf 
| ut 


email enclosed copies of 5 email communications gc 
from former Secretary of State HILLARY CLINTON s private email accaunt 
which STATE believed may contain “PEI eguities." STATE requested the 
FBE conduct an appropriato n review oL the emails prior 
ta theis sc ee FOI ‘A public release. üduvised these 5 emails 
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Approximately 1 week later, STATE's Ofrice of Legal Counsel (OLC) 
and questioned fhe FST’s SECRET/ /NOFORN determination 
cenia not rcocali the mame of tne E According tac ae," b3 
does not have an official government and therefore it believed the FRI 
COULO not ciassiiy a document paced on ne PGI caveat. OLO also 
advised that they, not the Eso are the judge of potentum » ham vis 
foreignu governments and the the FBE di | 

Gocumaent condition 
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Lional Operations Division 


(Tap) of the FBI wi "nramnsured" him to change the claskibjied email 
to Umciassifies., indicated be bad been contacted by PATRICE 
Y 
E S 


NENNEDY, Undersecretary of State, who had asked his assistance in 
Äer the emails Classification im exchange for a dd pro mq 
DU eg that, in exchange for Marii the email unclassif 
STATE wouid e ees by aiilowing the FRI to places more Agenta in 
countries du they are presently forbidden. 
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Following the above exchange, qmm was summoned to an "aii 
roy meeri at STATE to discuss 3 s : 
classification review GF pengin CLINTON 
from ST ATE, along with representatives Erom CIA, DIA 
other qovernment agencies wore present. PATRICK KENNEDY oresided 
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z X 

we Wi , A a a» xa - T ASSI. m A Ta oan Ah be fa k ohe 1 x RW en AE A 

over the meeting. During theo conversation, à participant specifi 


asked whether any of the GE im question were classified 

eye contact with EE KENNEDY remarked, "Well, we'i) 

Deiiceved this was reference Co the FEI's  CAULGgOrixatior 

ECRET/J/NOFORN email which KENNEDY was attempting. to influmen 
e 4 


private meeting with KENNEDY following Che alil agenoy meeting EYED 
Bese) whether the FBI Ps Pe their way to marking the SGIBELA 


SEH spent the next 25 mirutes 

3 attempting ta influence 
tne PBI Lo change ibs S MATKIT continued vo assert that 
Lhe email was appropriately marked SECRET//NOFONN, KENNEDY asked who 


d 


UE TA SX d wrung a ee RS AN vn dä SCH a e Viet 
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T 


else in the FBI he could speak with an the matter. [. |] referred 
KENNEDY toa MICHAL STEINBACH, Assistant Director oi TD., 


[| was chen present during a conference cali involving KENNEDY 
escurc the FBT to change 


and STEINBACH in which EKENNSEDY eontinued to pr 

the classified markings on the email Eo  unciassifLiedg. STEINBACH 
refused to do so. Prior to ending the conversation, KENNE "Dv asked 
— the FBI or STATE would conduct the pubic statements on the 
matter. STRINBACH advised EZNNEDY inant the FBI would not comment 
ublicly on the matter. The conference call ended and, according to 

E the Associated Pregs (AP} published the story within the hour. 
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snortiy thereafter to deny Reving sent class ified emai is on het 


private email server. 


| | | believes STATE has an agenda which isvolves minimizing the 
claseified nature of tbe CLINTON emails in order to E SLATE: 
interests and those of CLINTON. Since bbe above incidents, laf 
TATE involving FSI 
BORET//NOFORN. 


DÉ 
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received approximately 8 or 9 moro emails From 38 
equities, i of which he believes may be classified S 
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weede] edes Bureau of Iinvesugation (E BI ES 
niernadhionsi Operations Division (0D, who m currenily GER 
retirement on wüs interviewed in person by FRI Special Age 
Supervisory Special Agent (SRA) located at 
fier being advised of ine identity of E inferviewing Agents and the nature of the 
interview, provided the following intormation 
(uee As O [interacied with PATRICK E. KENNEDY, U.S. i 
iepartment of State (Do3) Under Secretary of State for Management. [and KENNEDY S 
reignionsinp was professional, The fwe gol along, but did not agree on many matters related to ihe FRI s 
roie amd authority overseas. 
(AFC In late May or suriv June, und a note on his desk indicating «ud 


KENNEDY contacted him. ‘as Surprised, as both bis Assistant Director {AD} TOWN 
BOLES and Executive Assistant Director (EAD) RORERT ANDERSON, had both been trying to contact 
KENNEDY for months without response. 


(Li poco giel kenne RENNEDY’s call, RENNE RS Y sk | Ss S 
assistance in chaneins a classification o£ FBI information contamed in an ems sch rhe 
provid with the e-mail, however be t 
FBi's Records Management Division (RAIDS 
document was classified. 






was the one that told KENNEDY the 


CURSES) KENNEDY wid dea the FBEs classification af the e-mail in question SE 5 
caused problems for KENNEDY and KENNELYY wanted to classify the document as "B9,^ KENNEDY 
further stated that the "B9" classification would allow him to archive the document in the basement of 
1308 never to be seen again. waa not sure of what KENNEDY meant by a "B9" 
classification Note: Ro mey be a reference fra POLA exemption]. 

CUP) Not vel kmeswing the eenas content, J feta RENNEDY he wouid look 5B 
into the e-mail matter T KENNEDY would provide authority concermnug the PBE'S request to increase Hs SS 
personnel in iad. 

Bremen, EE, aso sagen tc attamen m 
DTE 


e VM H k SEH ty 


SR = 3 
ity | MA o 
CUL LED Loma. FRRRLAVVWSARLLLLLLLLLEA Lh LR sf hhh hE B LER LL LLL LLL LLL EE LLL Eo s -- c So Sa xL USA LADO 
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(LUPO Following hia conversation wih KENNEDY |... komed | to 

discuss the e-mail Ld emal ot KENNEDY s concerm svas 

classified by the FBE Counterterrorism Division (CTD) and was related to the attacka on the LLS. 

Consulste m Benghazi, Pallowing his conversation with ontacted KENNEDY 

und informed him that there was ne way he could assist KENNEDY with declassifving the information 
CAPER 


contained in the e-mail. 
| ipid ANDERSON and BOLES about KENNEDY's request io 
decisssify the e-mail and respónse denying ihe ability to do sa, however. 


cha nat discuss the content af the e-mail with them. 







(Rec Tr Agenti notes are mamtaied m a LA envelope. 
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U/FOUE) On December 16, Tied Owner and à Chief Technol E 
In early 2013, a business associate o contacted her about a client who 
needed a new email server. Afte expressed an interest in the project and understood the clients : 
were HILLARY AND WILLIAM CLINTON, ut her in contact with CHERYL A 
few othe] _Personnel assisted with invoicing and technical aspects of the contract, M 1 e 
most of the work herself.| [primary contacts were MILLS and BRYAN PAGLIANO; MILLS SS 
helped prod he proposal and PAGLIANO assisted in developing the requirements for the server 
mae Tamed the discussion by providing a range of options from low-cost Gmail to a 
more sophisticated private server. She understood the client’s impetus for the project to be 
reliability/uptime and security in the wake of a situation where the client's private server housed in their 
residence experienced one wee wntime because of a storm. The client selected the private server 
f e options provided by Backup systems were planned for Phase 2 of the project, but 
p not involved in those decisions. 

(UFOS) Ny part of the initial conversations with PAGILIANO and MILLS[ keen at b6 
one point the domains and number of email accounts on the server, but could not recall those details. b7C 
EN zh no knowledge of email servers owned or operated by the client prior to the 
equipment maintained by PAGLIANO. 

(U//FOSO) After the client selected a private server} | contacted two firms she had prior 
A with: SEAYITAS, a large Information Technolo and PLATTE RIVER NETWORKS 
(PRN mi we firm. After the client selected PRN worked with MILLS, PAGLIANO, 
and o ‘develop the details of the project. was only involved in one b6 
or two meetings;| believed he was curious about the process. PAGLIANO handled the technical b7C 

the project and MILLS handled strategic concerns. As PRN took over day-to-day man i 
WEE gradually faded out. The client occasionally reached out for assistance nf 
wo elp where she could, Payment for her services was billed for the entire task, not hourly, so she 
. did not charge any fee for this assistance. 
Investigation on. 12/16/2015. — at. New York, NY "^ b3 
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(w/Fede) ^ believed a CloudJacket-type security device was part of the project design, so 
when it wasn't part of the initial instali, she pushed for the implementation of it after the migration from 
the PAGLIANO server to the PRN server. During the migration, she was not in the weeds, but knew 
enough to know it was done correctly from a security standpoint. was not aware of any security 
intrusions or compromises while she was involved in the day-to-day operations of the transition, nor was 
she brought back in after the fact on any security Issues. In addition to the CloudJacket, as part of the 
security considerations, discussed transitioning from BlackBerries to the iPhone with the client, as 
well as blocking international access to the server. Ultimately, the client chose to stay with BlackBerries 
and international blocking was declined because the client frequently traveled internationally. 


FOGO) Since press reports of] association with PRN and the CLINTON’s went 
public id some partners contracte Security to conduct Vulnerability Threat 
Assessments for some of their shared clients. was not aware of any such assessment conducted 


on the CLINTON's server. 


(u/reue)  ]haà no knowledge of the following topics as they relate to the PAGLIANO or 
PRN servers: | 
e moving emails to a new domain 


e laptop backups 

e temporary backups 

e classified information 
e federal records 
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(U/FOUO) OnMay23,2016| |dateofti interi c 


by Federal Bureau of Investigation (FBI) Special Agents (SA and S 
at the offices of Platte River Networks (P 0 Washington Street, D 
80216. Also present for the interview wa and via speaker phone, 
both attorneys at the After being advised of the identity of the interviewing agents and 
the nature of the interview rovided the following information: 
l 
(ugoe! ] was given PRN administrator credentials to the Clinton Executive Serv] BS 
| j ould not recall logging in to the server. understood SS 
were in charge of handling the CESC clien recalled he | 


assisted with the CESC client less than five times. He recalled he once assisted someone from CESC in 
updating their operating aaen! ` | talked tof |Last Name Unknown (LNU) from CESC most 
times. 


(Ueu  ]was not aware of a laptop containing an archi ail belonging to ES 
HILLARY CLINTON that was shipped to PRN around February 2014. as not aware what S 


became of the foregoing laptop. 


(U/FOEVe was not aware of any support PRN provided the CESC client from October fe 
2014 to 015 was not aware of any CESC request to delete, wipe or shred their email £ 
records. was not aware of any email content being transmitted to CESC. 


(U//FOUO» At this point in the interview, Agents displayed PRN provided records and email from i 
the March 2015 timeframe. rovided the following information: | 


| b6 | 
(umesel  ]was not aware of a trip made by PRN employe| ke the EAE 


Equinix data center in Secuacus, New Jersey. 


(U//FOG t6) After Agents displayed an email dated March 09, 2015 where CHERYL MILLS 





discussed preservation of materials had no knowledge of the email or any request by any entity ES 
to preserve CESC related data. - 
Investigation on, 05/23/2016 at Denver, Colorado b3 
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stated CESC never requested their email content by deleted, wiped or shredded. 


(u/geuey was unaware of any PRN employee conducting manual deletions of the 
DATTO device used to back-up the CESC email server. 


(ueesel  ]|was unaware of any successful computer intrusion of the CESC server. 


(U//FO/O) Notes of the interview and documents displayed to| ^^ — ]will be maintained ina 
FD340 envelope and filed with the captioned investigation. 
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ROHO) Or E 201 S —— Assistant to President William J. Die REIP e 2 


| a? erviewed telephonically by Federal Bureau of Investigation (F 
Special Agents Representing and also present for 
the call, wasL___—s fom The Department of Justice 
(DoJ) Counterintelligence and Export Control Section also participated in the call. After being advised of 
the identities of the interviewing agents, and the purpose of the interview provided the 


following information: 


ot familiar with Tor, which enables anonymous communication, nor b6 





di | described herself as a “very low tech person.” DIC 
| (U//FOUO) used various communication devices and computer to remotely sign into b6 

her @presidentclinton.com email account. These devices included an iPhone, BlackBerry, and on rare Sit 

occasions, a laptop. so accessed her @presidentclinton.com email account from her desktop 


desktop computer operated off of Windows, but she 
urther stated that she used an Apple Mac on occasion to 





computer at the Clinton Foundation. 
was not sure of the specific version. 
sign onto her email. 


(u/sFoee] Jia not recall experiencing any unusual spam or phishing email activity | - 
p C 


related to her @presidentclinton.com email account in January, 2013. was in New York on 
January 5, 2013. 


(U//F99€9 À copy of the original interview notes are attached ina !A envelope. 
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On September 14, 20] KE? | Platte River Networks, date of birthf OO ëO Gs 


social security numbe interviewed by Federal Bureau of Investigation (FBI) Special 
an 


A Lom Also present for the interv ZC 














D6 


In February or March 2013 as informed by 576 

— Platte River Networks (PRN), of a potential contract managing email for a high 

profile client, but did not know SS? the chent was. s was not involved in the proposal or technical 

jon for the client. he hz hand meetings with anyone representing t 
| _ handled those matters. 
[LINTON and HILLARY CLINTON (CLINTON), doing 
business through a company named CESC. At some point onang the process, CESC conducted 
background chec ould rt for the contract. Those 
individuals were and did not know why CESC 


conducted the background checks, but assumed it was because they were a high profile client. 


b6 


On or about March 201 sl e] first learned about concerns regarding CLINTON’s use of a BIC 


private email server when it was reported by the media. Due to this increased attention, PRN decided to 
place Internet Proto untry blocks and took other additional steps to secure the CESC server. In 
the same timeframe participated in a conference call with C `s counsel, Williams and 
onno]lv, to dete LINTON's email was stored. While as on the call, 
n handled most of the questions. Subsequently, PRN received a preservation 
etter from the United States Senate and a preservation request from the FBI. PRN brought their own 
counsel on board to assist with these requests. 








After receiving the FBI’s preservation request, PRN received a letter from Williams and Connolly 


insiructing them to give the FBI the CESC server used prior to migrating email to P | Y 
| traveled to New Jersey and turned over the server to the FBI. tated BIC 






not power up the server before providing it to the FBI. 


The CESC email server architecture also involved a DATTO backup appliance. The DATTO was 
configured to store backup data locally, however, due to a glitch, DATTO backed up data to their cloud 
for a period of time. On or about August 24, 2015, DATTO sent PRN a letter stating they would stop 
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backing up to their cloud and preserve what was in their possession. The DATTO has a 60 day purge 
cycle, therefore, DATTO should have data from 60 days prior to August 24, 2015. 


: | b6 
[ond have specific details regarding the CESC -— 
email server project never heard anyone related to the CESC project discuss the existence of 


classified information on the server. 
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(U//FOUO) On May 23, 201 E enel date of bi 
by Federal Bureau of Investigation (F pecial Agents (SA d5 
at the offices of Platte River Networks (PRN) located at 5700 Washington Street, Denver, Colorad 
80216. Also present for the interview a lee via speaker phone, 


both attorneys at th After being advised of the identity of the interviewing agents and 
the nature of the intervie provided the following information: 


(mee! ` | was not aware of a laptop containing an archi mail belonging to 
HILLARY CLINTON that was shipped to PRN around February 2014. was not aware what 


became of the foregoing laptop. 


uma | only recently was made aware of a CLINTON email archive file being 
i ] lye Services Corporation (CESC) around July 2014 and 
b as not aware of the request by CESC, or transmittal b 
as 1t was occurrin was of what specifically was requested by CESC or exactly how 
fulfilled the Bed "` es spoke with anyone at CESC. 


(U//FOUO) was not aware of any support PRN provided the CESC client from October 
2014 to January 201 was not aware of any CESC request to delete, wipe or shred their email 


records. 


(U//FOUO» At this point in the interview, Agents displayed PRN provided records and email from 
the March 2015 timeframe! provided the following information: 


(U//FOQEO) In March 2015, when various media outlets reported a private email domain and 
server was used by HILLARY CLINTON, PRN decided to create an internal *share drive" and control 


access to only the PRN employees working the CESC account. PRN never deleted information pertaining 
to the CESC client and provided the FBI all records they maintained pertaining to CESC. 


(U//FOUO) In March 2015 stated PRN employee|__}tavelled to the 
Equinix data center to check the security of the servers and to ensure they were “locked tight.” After the 


media reports, PRN was even more concerned about the security of the server. 
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(U/4OUG) After Agents displayed an email dated March 09, 2015 where CHERYL MILLS 
discussed preservati wgl `! could not recall any other request by any entity to preserve 


CESC related da received guidance attorneys and understood CESC client 
information and records should not be destroye believed the preservation request applied more 
to CESC records and not necessarily email content. clieved the preservation request to be a 
request from the government. 


(U//FOUO9 d no specific recollection of a conference call on March 25, 2015 or March 
31, 2015 with CESC stated CESC never requested their email content by deleted, wiped or 


i M a memory of a request by confirm their server back-ups were still 
working, but could not recall the specific request. was aware CESC wanted their email retention 
policy changed to 60 days. 

(umegel | was unaware of any successful computer intrusion of the CESC server. 


(U/FECO) Notes of the interview and documents displayed t| [win be maintained in a 
FD340 envelope and filed with the captioned investigation. 
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On August 17, 2015, KATHERINE M. TURNER, Partner at the law 
offices. of Williams & Connolly LLP, 725 Lg" Street, N.W. Washington, 
D.C. met at her place of employment with Agents of the FBI to discuss 
voluntarily turning over six (6) laptop computers in her possession 
to contain Top Secret classified information. Also in attendan 

of the FBI's Office of General Counsel, — 

Trial Attorne for the 

Department of Justi 
Connelly LLP, and 
law offices of Paul, Weiss, 





b6 
H , , b7C 
Counterespionage Section at the 

an attorney with Williams & 
counsel for CHERYL MILLS, from the 


Rifkind, Wharton & Garrison LLP. 








Prior arrangements had been made to meet at this time and place 
to discuss an agreement through which Williams & Connelly would 
voluntarily turn over to the FBI six (6) laptops computers used by the 
Firm to view email communications from the private server of former 
Secretary of State HILLARY CLINTON. TURNER acknowledged that these 
laptops contain Top Secret email communications and attorney/client 
privileged communications. TURNER sought to turn over the laptops as 
soon as possible but wished to ensure that privileged communications 
on the laptops would remain confidential. TURNER declined to provide 
consent to search the laptops and wished to arrange for secure storage 
of them in a manner agreeable to both the FBI and the attorneys. The 
FBI agreed to provide TURNER with a draft’ letter outlining the 
proposed conditions of storage as soon as possible. 


Contrary to statements made on August 6, 2015, TURNER advised 
that only five of the six laptops are in the possession of Williams & 
Connelly, the sixth being in the possession of b6 
counsel for CHERYL MILLS, former Chief of Staff for CLINTON. SR 
admitted that the computer in his possession has been connected to the 
Internet on numerous occasions subsequent to being loaded with the 
classified email communications of HILLARY CLINTON. This laptop was 
possessed by CHERYL MILLS but utilized by HEATHER SAMUELSON, an 
attorney on her staff, to conduct a review of approximately 60,000 
emails originall contained on  CLINTON's private email server. 
According to —— SAMUELSON deleted CLINTON’s personal emails 


b3 
bTE 
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from the original 60,000 resulting in the 30,490 emails eventually 
turned over to the FBI. claimed the other emails had been 


deleted from the laptop but was unable to specify whether La: had 
been forensically wiped to an unrecoverable state. 


Both Led Sr TURNER admitted that the emails contained on 
these laptops had been viewed by attorneys who did not have a security 
clearance at the time they reviewed the material. TURNER said the 


emails did not contain classification markers and thus they were not 
aware that they were classified at the time. 
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(U/EGUO) OnDecember10,2015[ — ]dateofei] — ofthe Eë, 


Office of the Legal Adviser, Financial Disclosure Divisi ent of State was interviewed by 
Federal Bur igation (FBI) Special Agents d 
pe Trial Attorney, Public Integrity Section, U.S. Department of Justice and 


Aitorney Adviser, U.S. Department of State. After being advised of the identities of the 
interviewing agents, and the purpose of the i —— a À— 9Ó the following 1nformation: 
- (UFV) In 2009| — ^  ]worked as an Ethics Analyst for the U.S. Department of State. 
She was responsible for reviewing the Financial Disclosure Forms (SF-278) of new and current 
employees to assess If their investments, or outside i es, created a conflict of interest with iE 
their position at the U.S. Department of State. wiel had questions about the filer’s SF-278 b7C 
she would contact them directly, either telephonically or via email, to clarify the filer’s responses. 
wm then amend the SF-278 to reflect any corrections or clarifying information provided by 
the filer. She would then send a copy of the updated SF-278 to the filer for their personal records. Once 
the SF-278 was finalized an assessment was made on whether the filer’s investments, or other financial 
interests, posed conflict of interest. The assessment was then signed off on by 1 
Zr Upon completing the review a physical file containing the SF-278 and 
supporting documents were maintained for a finite period of time before it was destroyed. 
b6 


ureien! ` |] was shown copies of the following documents: | | b7C 


e New Entrant SF-278 submitted by BRYAN PAGLIANO on April 15, 2009 | 
e Email Sen) ` [to PAGLIANO dated August 25, 2009, with the subject “Ethics bé 


| Clearance... (Reply Requested)" DUM 
e New Entrant SF-278 submitted by BRYAN PAGLIANO on Apnl 15, 2009, with 
- handwritten updates. | 
e Incumbent SF-278 submitted by PAGLIANO on April 4, 2010 
(U//FOUO) After reviewing the documents) confirmed that she had sent the above b6 

referenced email to PAGLIANO to clarify some of his responses on his original SF-278. b7C 
provided that the email contained her original message to PAGLIANO and did not appear to have been 
E on — 12/11/2015 at | Washington, D.C. e 
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altered in any way| | also confirmed that it was her handwriting on the updated New Entrant 


SF-278 form and that the handwritten notes reflected additional information provided by PAGLIANO in 
response to her email. could not recall any additional information about her exchange with 


PAGLIANO, aside from what she had written on the updated SF-278. elieved that 


PAGLIANO had provided the updated information to her via email but she no longer had e emaj 
because she purged her emails when she changed positions at the U.S. Department of State. 
further noted that the physical file could not be found and had likely been destroyed. 


(uAEouo] ]eviewed the Incumbent SF-278 form filed by PAGLIANO and noted that 
she did not conduct the review of that do pointed out the checkmarks on the form and 
they were not her EE know who reviewed the form but stated that 

mm noia be able to identify the reviewer based on internal computer records. 


(U//FOGO) With respect to the Incumbent SF-278 form filed for 2009| stated that all 
income and compensation from 2009 should have been captured in Schedule A. This includes any 
income in the calendar year, even if it was received prior to his start date with the U.S. Government. 

oted that the only exception to this would be if the income was from another government 
entity. However, income from a political action committee or another campaign related organization 
would not qualify as other government employment. 


(ueoue| ^ noted that in 2009 the filer would have been provided with several pages of 
instructions on how to correctly and accurately complete the form| ‘provided an electronic 
copy of the instructions to the interviewing agents. 


(U//FOUO» A copy of the above referenced documents and the original interview notes are 
attached ina LA envelope. 
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On September 2, 2015,| | 1] a Special Agent with 
Homeland Security Investigations (HSI), Department of Homeland 
Security (DHS), Norfolk Virginia, was interviewed at the Federal 


the interviewing Agent and the nature of the interview, 
provided the following information: 


Bureau of Investigation (FBI). After being advised of the eem of 


was previously an agent with the U.S. Department of 
State, Bureau__of Diplomatic Security (DS). left DS in 
approximately spouse, was also a 


prior DS agent who, from 2007-2009, served as an Assistant Shift 


Leader on former Secretary of State CONDOLEEZZA RICE's and HILLARY 
CLINTON’s protective details. [ 1] served briefly on former 
Secretary CLINTON’s protective detail in 2009. From her own 


a and information obtained through| Lang other agents, 


described a “stark difference” between RICE and CLINTON with 
regard to obedience to security and diplomatic protocols. RICE 
observed strict adherence to State Department security and diplomatic 
protecols while CLINTON frequently and “blatantly” disregarded them. 
For example, it is standard security and diplomatic protocol for the 
Secretary of State to ride in the armored limousine with the local 
U.S. ambassador when traveling in countries abroad. It is seen as 
diplomatic protocol for the Secretary of State to arrive at foreign 
diplomatic functions with the local ambassador; however, CLINTON 
refused to do so, instead choosing to be accompanied in the limousine 
by her Chief of Staff, HUMA ABEDIN. This frequently resulted in 
complaints by ambassadors who were insulted and embarrassed by this 
breach of protocol. . explained that  CLINTON's protocol 
breaches were well known throughout Diplomatic Security and were 
"abundant." 


explained that ABEDIN possessed “much more power” over 

CLINTON’s staff and schedule than other former chiefs of staff. 

believed that ABEDIN herself was often responsible for 
overriding security and diplomatic protocols on behalf of CLINTON. 


Investigation on 99/02/2015 oat Chesapeake, VA 
Filed | |- Zant "2 —  Datedictated — N/A 





This document contains neither recommendations nor conclusions of the FBI. [tis the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


bö 
b7C 


p6 
b7C 


DÉ 
b7C 


b3 
b7E 


b6 
p7C 


FD-302a (Rev. 10-6-95) 


b6 
Continuation of FD-302 d mad č Le , On_09/02/2015, Page 2 b7C 


On a trip to Jakarta, Indonesia, in early 2009, CLINTON requested 
to visit an area of Jakarta that presented security and safety 
challenges. This visit was reportedly for a photo opportunity 
regarding CLINTON’s “clean cooking stoves” initiative. The DS advance 
team recommended against traveling to this area because the route 
could not be secured and was lined with dangerous circumstances and 
individuals. As such, the DS advance team recommended in writing that 
this excursion be stricken from the schedule but were told by DS 
management that it was going to happen because "she wanted it." DS 
agents felt this excursion into potentially hostile areas placed 
CLINTON, her staff, the media, and her security detail in unnecessary 
danger in order to conduct a photo opportunity for “her election 
campaign.” DS agents had the perception that CLINTON was using her 
position as Secretary of State to campaign for President of the United 
States. DS agents felt CLINTON traveled with hand-picked media who 
would present her in favorable light in order to garner political 
Support. It was also believed that CLINTON disregarded security and 
diplomatic protocols, occasionally without: regard for the safety of 
her staff and protection detail, in' order to gain favorable press. 


CLINTON traveled in an armored vehicle whose passenger windows do 
not open. This is a design feature for the protection of the 
occupants. However, the driver's window does open slightly. On one 


occasion while traveling to Palestine, CLINTON ordered the limousine 

s: | E , ! b6 
driver, believed to e to open the window while in p7c 
"Occupied territory", re mg tO a dangerous area of the West Bank. 
Cat declined to respond to CLINTON’s request; however, 
Yepeated demands by CLINTON forced him to open his window despite the 
danger to himself and the occupants. 


explained that security and diplomatic breaches were 
often communicated from the foreign post back to the Department of bé 
State via cables from the Regional Security Officer (RSOL b7C 
cables often described incidents like those described above. 
recommended interviewing current and former RSOs from foreign posts 
visited by CLINTON during her tenure for more detail into these and 
similar events. 


Early in CLINTON's tenure as Secretary of State, she and her 
staff were observed removing lamps and furniture from the State 
Department which were transported to her residence in Washington, D.C. 
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does not know whether these items were ever returned to the 
government upon CLINTON’s departure from the State Department. 


Interview 





Despite having her own DS security detail, CLINTON continued to 
utilize a Secret Service security detail while at her residence in 
Chappaqua, New York. DS security would meet Secret Service security at 
the airport in New York and turn over protection to them. This 
practice was unknown to DS prior to CLINTON's t e and often 
presented logistical problems to both lt E] explained 
that CLINTON's treatment of DS agents on her protective detail was so 
contemptuous. that many of them sought reassignment or employment 


elsewhere. Prior to CLINTON’s tenure, being an agent on the Secretary 


of State's protective detail was seen as an honor and privilege 
reserved for senior agents. However, by the end of CLINTON's tenure, 
it was staffed largely with new agents beca was difficult to 
find senior agents willing to work for her. laimed to have 
had at ‘least one conversation with Secret Service agents who 
experienced the same poor treatment. 


Inside CLINTON’s office at the Department of State there is a 
security checkpoint known as "Post 1." Post 1 is staffed by a 
uniformed DS officer and a DS agent and provides security to CLINTON’s 


b6 
bic 


b6 
p7C 


p6 
b7C 


inner office. CLINTON'S office is a Sensitive Compartmented | 


Information Facility (SCIF) and Post 1 is located within that SCIF. By 
DS security policy, no cell phones are allowed inside the SCIF and DS 
agents, officers, and staff are required to leave their ceil phones 
outside the door in secure lockers. CLINTON refused to abide to this 
security requirement and brought her cell phone, believed to be a 
Blackberry, inside the SCIF where a DS agent assigned to Post 1 was 
required to guard it. DS agents were indignant that they were required 
to follow security policy but CLINTON made herself exempt from the 
same regulations. 
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(U/FGEO) On February 10, 2016 
Federal Bureau of Investigation (FBI) Special Agent 
offices of Latham & Watkins LLP, 885 37 Ave, New York City, NY. Also present wer 

of Latham & Watkins. After being advised of the identities of the interviewing agents, 
and the purpose of the interview, provided the following information: 


ewww dt Ch 


He was formerly the 
t the Department of Defense (DoD) fro mL sid Prior to the DoD be 
Nationa] Security Counci! (NSC) from | untill [During that ti 
‘from fto 


| dfrom| ^ Juntilear| —— Jandthe 


(U//FOG9) provided that Been were ebe, three to five Deputy Committee (DC) 
meetings a week, up to four Principal Committee (PC) meetings a week, and NSC meetings with the 
President as needed. Additionally, there was a weekly lunch between Secretary GAT ationa 
Security Advisory DONILON and Secretary CLINTON[ | provided that 
the DoS representative for DC meetings and 2 SES CLINTON was the DoS representative for PC and 
NSC meetings. 


rviewed by 










(U//FG39) While at the nscl — | was responsible for working with the meeting 
participants, to include the Department of State (DoS), to coordinate and plan for each upcoming meeting. 


More specifically, ould review memorandums, prepare meeting packages and control the flow 
of info j een the agencies. These interactions occurred through both formal and informal 
channels rovided that with respect to DoS matters he primarily worked with JAKE 


SULLIVAN and JOE MACMANUS. 


(U//FOUO) Prior to each DC and PC meeting the NSC would notify the participants of the 
upcoming meeting and ask that they submit their meeting packages in advance so that they could be 
distributed as read ahead material rl stated that he routinely worked with SULLIVAN to ensure 
agendas, talking points, and formal documents were received in advance of each meeting. 
mmm that he would sometime provide relevant documents, such as ODNI assessments, to DoS 


Investigation on. 2/10/2016 at New York, NY 
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for their use as they prepared their meeting packaged č | stated that the classification level of the 
packages was dependent on the content and could be unclassified, classified or a mix. Documents and b6 
meeting packages were typically transmitted between agencies via the appropriate email system, secure bic 
fax (Le., Washfax) or courier service. 


(U//FE¢8) Following each meeting an NSC staffer would take notes and then prepare a 
Summary of Conclusions (SOC) that summarized the issue discussed, supporting and dissenting opinions, 
the final outcome and any necessary action items. The SOC would then be approved by the NSC 
executive staff before being distributed to the meeting participants. 


b6 


ueeee[ þras not aware of how or where the NSC archived the SOC aid related ` Lie 
documents for a specific DC or PC meeting. ; 

(U//FOUO) was shown several emails that were sent in preparation for an October 2009 
PC meeting regarding the U.S. strategy in Pakistan. However, after reviewing the email stated ; 
that while he remembered the topic in general he could not, recall the specific ing in question. He — b6 
noted that at that time there were numerous meeting on the subject ( ould not recall pc 
the details of any of the documents referenced in the emails. wi four not comment on the 
specifics of the emails he did note that the emails were representative of the communications that were 
exchanged between NSC and DoS as they were preparing for a PC meeting. 

(LOGO was shown an email that was sent in preparation for a June 2011 PC Lë 
meeting. However could not recall any specifics regarding the PC meeting in question given — 


the limited content of the email. 


(Ugen A copy of the original interview ntes and the Sep emails are attached ina 1A 
envelope. 


SBSRET/NOFORN 
Jas 
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LATE 10-13-2016 BY J37G85T94 NSICc Dato tianscHpüdh . 10062015... 
 (U//FOUO ) On 10/2 Special Agent (SA Federa! ^" EN eau b6 
TT bn (FE SSAN was interviewed i in person by sl b7C 
LP S in FB] oc | advised of the identity of the 
interviewing Agents and the nature of the interview FS the following information: 
(LZ began working for Department of State's (DoS) Diplomati d 
ervice (DSS) in where he was assigned to the DSS Los Angeles Field Office. In ae 


as selected for an assignment with the Secretary of State’s security detail. 
served on the Secretary’s detail il 1] when he joined the FBI as an SA and attended FBI] 


new agent training. 


(UFOO) Whe 15 stint on the Secretary’s detail, CONDOLEEZZA b6 
RICE, was the Secretary of State detail assignment carried over to HILLARY "HE 


CLINTON, when she was appointed Secretary of State in 2009. 


(U//F G05 DSS covered the majority of CLINTON’s protection while she was in the 
Washington, DC, area. However, when her husband was in town, United States Secret Service (USSS) 
would cover the bulk of the protection detail responsibilities when she was with her husband or in the 


residence. 


(U//FOHO) USSS would provide security for CLINTON’s 3067 Whitehaven Street NW 
Washington, DC, address during the day and DSS wouid cover the overnight detail] ]was x3 
never inside the CLINTON’s Whitehaven residence, as DSS usuaily posted in a vehicle outside. 
CLINTON had a secure telephone in her Whitehaven residence E TL it was ina 
secure room. 


(U//FOUO) CLINTON usually traveled to her home in Chappaqua, NY, via a US Airways shuttle 
from Reagan National Airport (DCA) to Westchester County Airport in White Plains, NY. USSS would 
handle CLINTON's security in NY, and DSS would have a small presence to maintain CLINTON's 


communications. was never inside CLINTON's Chappaqua residence bf 
was known as the CLINTON's Chappaqua "house guy/scheduler.” The security detail would often Eee 
contac to determine the Secretary’s departure time. 

p3 
Investigation on 19/26/2015... sat Washington, DC — ae RES " 
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(U/PORHD) The Secretary's security detail chain of command was as follows: 


| Special Agent in Charge (SAC) 

4 Assistant Special Agents in Charge (ASAC) 

3 Shift Leads (SSA) 

Approximately 45 SA’s assigned directly to detail shifts 






bé 
BTC 








was the SAC during CLINTON’s tenure as 
were two ASAC’s during the same time pe 
SA, and both 
agents assigned with to CLINTON’s detail, 
all still employed with DSS (possibly in the Washington Field Office). 





(U//FOUO9) CLINTON's oftice was located on the 7^ floor of DoS Headquarters. The entire 
Secretary's suite was a Sensitive Compartmented Information Facility (SCIF). The DSS security 
detachment maintained a Post directly outside the Secretary's office. The DSS space was known as Post 
One (1). DSS personnel were not authorized to bring their mobile phones into Post 1, as it was located 
within the SCIF. CLINTON did keep a mobile phone inside a desk drawer inside Post 1, but when she 
would remove the phone from the desk, she wouid take it to a non-SCIF space to make calls or use the 
phone. 


(UFOS) HU MA ABEDIN and CHERYL MILLS were among CLINTON’s staff members 
i r Secretary’s SCIF. In addition to ABEDIN and MILLS, 
and JAKE SULLIVAN, were part of CLINTON’s main 
“traveling crew.” MILLS did not accompany CLINTON on many overseas trips. 


uu/rede|  ]oul not recall the specifics nu "`` tg used by 
S 


CLINTON’s executive staff, but he assumed they were BlackBerry device did not interact 
with CLINTON nor MILLS via email, but sometimes he would receive a forwarded email with their 
accounts listed in the chain. remembered receiving email chains that contained 
Clintonfoundation.org accounts also thought he recalled seeing emaiis from 

originating from a Gmail account, however, he was not entirely sure. 


bo 
bic 


b6 
DC 


(UVEO) In addition to the Secretary’s DSS security detail, CLINTON also traveled with a 
team of Security Engineers who were specifically assigned to her staff. These Security Engineers would 
travel overseas with CLINTON for the specific purpose of setting up and maintaining her 
Communications while on travel. The Security Engineer Team generally set up a secure communication 
post inside the Embassy, or a hotel room adiacent to where the Secretary would stay. [he communication 
post would be manned 24 hours a day. 


pd 
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bl per DOS 






was unaware oT the process and procedures related b6 
to the preparation and transport for overseas travel. bic 
(UFO When traveling overseas in advance of, or with, the Secretary, the Regional Security 
Officer (RSO) would usually provide CLINTON's security detail a letter, prior to, or on arrival. The letter 
rovided guidance on what to expect from a security standpoint while in a particular country. 
po od not sure if a similar letter from the RSO was provided to the Secretary and/or her b6 
executive staff. ST 
(U/PFOGO) The Secretary’s security detail would “hotwash” after an overseas trip, to compare the 
advance team's preparation to what actually t lace during the Secretary's travel. The RSO was not a 
part of these after action discussions believed an RSO wouid send a cable to the RSO b6 
assigned to the Executive Office at DoS Headquarters if there were any security issues concerning SZ 


CLINTON and/or her staff. 


(UFS) Agent notes are maintained in a 1A envelope. 


Spero Fon. 
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United States Department of State (STATE) 515 22" Sireet NW, Washington, 
D.C. 20037, otiice telephone Qo — ] mobile telephone oo] ] email estate. coy, 
i p" interviewed on his mobile telephone by FBI Special Agen 
After being advised of the identity of the interviewing Agent and the nature of the interview, 
provided the following information: 






The Information Pro grams and Services (IPS), Bureau of Administration oversaw the program for 
Congressional inquiries and Freedom of Information Act (FOIA) requests. The House Select Committee 
on Benghazi requested emails to or from former Secretary of State Hillary CLINTON related to Benghazi. 

t was determined there were 296 emalis related to the Benghazi request. After IPS officials performed 
their review of the 296 emails; they referred emails for classification determination te four outside. 
agencies, specifically the: 1} FBI, 2) CIA; 3) Department of Defense (DoD); and 4) National Security 
Council (NSC). 


IPS officials have regular points of contact (POCSs) at all agencies and STATE bureaus that the 
IPS would send classification determination referrals to in response to Congressional or FOIA requests, 
The regular POCs at the agencies listed above were as follows: 
tact information. provided. 
no contact infonnation provided[ boss wa| — | 
s FOIA branch similar to STATE'S 
email wa GOUCH OS, BE 


ee. EE CR RU yl 


Office of the Secretary of Defense (OSD)}—no contact information b7C 








provided 
OC earlier in 


i uc] | | retired n e 
:lepheóne 20. 


Ce NSC's current P V 
iBiius nou dV. believe vight inform 


Legislative Affairs, if contacted by the FBI. 


he Benghazi request 
email 
















and 


Before IPS conducted their review of the Benghazi request 
Attomey, Office egal Adviser performed their own, independent review of the 296 Benghazi- 
related emails. review used difierent POQCSs at other agencies to review the 296 emails for 
a classification determination. mm id not know why: TEN team did a review, as that was 
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Clantiigation aP Pip ah af 
IPS" purview: 2) why 






Maa PERAE GU "A 
E E EH 


SS Lused diferent POCs than the re gular POCS IPS 
review enteria and/or parameters eam used during their review; and 4) why 
reviewed and produced the 296 emaitis to the House Commitiee priar to IPS conducting their formal 
DOWRCW, 





eam used reviewers from the following agencies: 13 Department of Justice (DOT: 2) 
CfíA; 30 DoD; and 4 White House Counsel (EIC. icam's POCs were as follows: 
- M37 -íiniephone 212 


- CLA: When asked direciiy who the CIA reviewer was| ^ and her team stated they did 
coordinate through thè CLA bni to date, had not given a name Por wpo their CLA reviewer wis. 
aot telephone FU. omen 












telecine “qf 1] email] kk GES SU Ny, 


did not Know why tetun used a POC at the DO instead of the FBI and a POC ai 
the WHC insiead ofthe NSC. | amt fo provide his moughts on why he thought they used 
the wrong POCS. [ _ktatea that cam made a "rookie mistake" when they used the WHC 
insíead of the NSC. 


[summed ap the issue with the different POCs as fhistrtine and again nointed out that IPS 
referred the 296 emails ta the NSC. FBL CIA and Dal wheres mes reierred ihe 295 emais 
to the WH. DOE CLA and Dot), and none of the referents were known to be ihe same between IPS 
tenm and teem. 
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| FUR SIMES i of State STATE) 315 22" ipeet 


Daieofuwmonoson  CRAERSOGOIS; O 


T 


- enn mL t NW. Washington, 
1 








DC, 20037, office tele me ne 202] mobile telephone (202 

dais of birth vas interviewed in person by FBI Special Agent 
ai FST BE 933 Pennsylvania Avenue Northwest, Washington, EC. Z0 

heme advised of the identities of the Interviewing Agents and the nature of the interview 


the following intonnaiion: 


farted working RC STATE N {asia sinc] fans ihe 

for Margaret "Pesos" GRAPFELD, Demity Assistant Secretary, who was responsitde für 
overseeing 300-500 employess seho work on matters related to the Freedom of Information Act (MCHA, 
the Privacy Acl and information masagement for STATE, A/GIS was the offies that provided wuidance, 
usually through memorandums, that oversaw records compiancs for all STATE employees. AAS also 
oversaw the coordination, production and maintenance of STATE’s Foreign Affairs Manual (FAM 
though AAGHS was not resnonsible for the FAM’ s content. 


"osi 




















Acministration, was 





icyes BAR, Assistant Scoretary, Bureau of 
GRAPELD’ s boss and inunediately subordinate to Under Secretary for M anagement Patrick KENNEDY. 


In or around August 2014, | 


: A CA UM ac s P» i^ wir 1 th tr, 


[e rise Amir ga 


€ 
NENNEN, SE ATE'S i: episin aity e Alfairs. Ho veas around that time thet] o p 
learn about records BT the FOIA pe € Around the same time] E 


telephone call from ay ic Legal Adviser, who asked f A were 


any CLINTON-related ex in the pat file that ad fr jonas FHA 
request. [denser ak iat there were CI LINT ON-reisted emails in Gg psi Die 


COR 3 UPS, Burean of Administration oversaw the FOLA. 
he 


iae informauon Programs and Serv 
r 2014, In response ta a FOLA request, OPS officials were 


e 
h 
program. in or around November or Decem 


notified they would pick-up 14 banker boxes of emails at former Secretary of stale Hillary CLINTON S 
office related to CLINTON s nse of personal email to conduct official STATI: business. Later 





A ard dard, erre lh 


Peewee 
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21 boxes at Williams & Connol ly, LLP. On or around December 4, 2014, 
icked-up 12 boxes at W illiams & Connolly ly. [  — 7T] ai [PS be 
officials were unsüre what — tq the other two boxes. The tems in the boxes were stacked with na — P7C 
fniders or known method af orgamation. 








3Gipbud Pubiishins holutiona, vio used classified copiers z aad made twa-sided 
copies of ali recetved materials for & copy for officials in 31 m Executive 
Secretariat (S/ES), and a couple of copies for IPS officials to use for their FOIA review. The original 
emails were shrink-wrapped and placed in a sensitive comparimented iuformation facility: in Newington, 
Virginia. 
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ust heard of issues with the CLINTON -related FOIA, process. 

the FOLA program. Tne nomal FHA process wauki be whore IPS 
reccied a FOIA request, then IPS forwarded that request on STATE forms via emali to the person who 
the FOLA request peris mag to, The pertinent marty wouid then SH out ihe farm and provide the IPS office 
the requested Hema, which the [PS office then reviewed prior to a release of the information hack to the 
initial requestor. {nthe CLIN TON-related FOIA case, IPS received an unprecedented amount of emails 
in hard copy form, as there were 52,454 work-related pages to review. In a letter hand-delivered to 
KENNEDY by Cheri MILLS, or MILLS attorney, it was stated, “in an abundance of caution, they 
overproduced.” 


b7C 


Separate trom the CLINTON- related FOLA request, there was a Congressional request for 
CELINTON-related emalis related to the Benaghu incident from the ee Select Conmumittee on 
Benghazi A review wax conducted of 206 emails, probably by per hu worked ip the Bursan of 
Legislative Affairs and Office afthe Legal Adviser. Statec Te KIRIW 
why snd how those 295 snecific emails were picked and why and how they conducted their own review, 
separate irom any review the IPS unitconducted. Previously, [PS had always been im charge af 
Congressional document producti on]  basd attorneys fram Legislative Affans and Office of the 
Legal Adviser would normally only secigh in on the legality and scope of requests, bul IPS would acmally 
conductthe review and production. om tated they coordinated the proper review of 
the material wiih STATE bureaus and other agencies, Afer iheir own roview was Buses] ——— ] and 

produced the requested material for the House Committes, reior and independent to the IPS 
ret a formal review, 


( ` kaiog those involved at IPS felt the 7 Aoor, or leading S TATE officials, had their own 
ideas on how to formally review the 296 emails, KENNEDY’s initial idea for how to review the 296 
email was as follows: Li the EPS officials conducl a review; 2} [PS officials referred items to other STATE be 
bureaus and infer-auency partners for their review; 3) IP3 officials received the referral determunations bc 
and submitted to the House Committee, Ze: review process that was finally decided upon wes as 
follows: D) fhe IPS offictais conduct a review; 2) EPS officisis referred nems o other STATE bureaus and 
inter-ageney pariners for their review; 31 IPS ur fücials received the referral determinations and submitied 


FD.SQIS (Rov, HO 
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Centususcen erp DIDI 0f —— innsviwo od e EEN 
bic 


io the Office of the Legat Adviser; 4) after thes Office of the Legal Advisers review, then it would be 
submitted £o the House Committes. 





ADM 


In mid-March 2015, [PS officials conducted their formal review of the 296 emails on their 
classified network, aka SCLASSNET," usi ng iheir Freedoms System, aka "F2." IPS felt immense 
pressure to complete the review quickly and to nat BE anything as classified. in IPA mial review, 

they dii uot use a Bb) ewenrpüuon on env of tbe ema fhe BC} exemption was used to exclude the 
publie release of classified information or matters e? ed to national security, IPS officials were told 
there was nothing classified in the 296 emails, so they shouldn't ase the B(1) exemption. 


However, fram the formal review of the 796 emails, ot total, | [tough there were four or 
Sve STATE bureaus, such as African Affairs Bureau and the Near Easter Affairs (NEA) Puree, snd 
five non- STATE agencies, xpecitically the PB, CLA, Department of Defense, National Security Council 
and White House Counsel, that were sent referrals Gtems/emiuis) io conduct fheir own formal ep 
classification review. The NEA responded that in the material they received there were four or five BO} Ai 
redactions thai needed to be made, After he heard this, Ile 'as frustrated and asked IPS officials if 
hev werg ` ‘going to EY SH desk eBicer Irom Maghreb" by usma the II} exempt n. 


asked, “Who a tS Weg'lino SC to explain classification to fhese ne pple” stated 
mulie Himes nt courdingted with other agencies anc Das previous 


experience with document production. S stated ` ‘NEA will change thelr B(D)s to BfS)s because 
they C«EA) didn't understánd how to classify tems.” A (5) exemption was not us: ed for classified data, 


mum lor privileged communications, Such as E ur allorney-related privileges. | de 






alse: stated, “it's not classified until] we nograde 1 


‘Phe review officiais the d ` ` kd kee for the review of the 295 emails were c " 


same pognal review officials that the IPS team use on a regular basis, For exsmmie anc 
did not pse the IPS normal paimt of contact for the PHI, Linstead used someone fom bE 
the EH of Hn ta count as the FRI reviewer. The name and stated they used pae 


for VV isuse Counseland the Deparimeni af Defense were siso not ihe regular reviewers the IPS tram 
used. an upon being asked directly, would not give a name of whe they coordinated 


reviews with at the CEA. 


Throughout the provess,| tated ivan emailfitem should have a B(1) exemption, then 
IPS would use a BCI) exemption. Despite that, ai the end of the referral process, IPS was told to run 
eve rything by Legislative Affairs ^ -— IPS officials felt utimidated when they used or suggested b6 
the use of the Bil} exenintion on any af the 296 emails, In addition to ed KENNEDY BIC 
were named ax some of the STATE officinis who pressured IPS employees to 









not label anyihing as classified 


In late April 2015, IPS officials completed the formal review ofthe Benghaztb related 
Congressional inquiry. Al materials were ready for release at that time. The CLA provided redactions, 


1 


CRiDTS rev P9) 


Uuntimx ati HOM nt F UM MIS of sanwo | MAT AT an a nr RR RR LE e Bee eRe aT d IET: RO 2S POSS , Pare ce omia m a bé 
BY 


but none wers deemed à B(l exemption. Aost of the nems w with CLA redactions were emails font 
sidney BLUMENTHAL. One iem was deemed classified acvordine to the FBI and KENNEDY held 8 


closed door mecting attended by the FEP aPPS| ——— [among others. Jn that meeting, 
KENNEDY ask tc change the FBI's BU1) upgrade classification, buf | dd not change ` DP 


t i A Ce t ^" En b5b7C 
the FBUs siance, On May 25, if was decided by the IPS team they would keep the upgrade of the one 
FBI-reiated &mail and the IPS officials sent David KENDALL, Attorney, Wiliama & Connolly, LLC a 
letter infonming him of the resalis. 












lhere was a powerful group of very high-ranking STATE officials that some referred to as “The 
7^ Floor Groun” or “The Shadow Government.” This group met every Wednesday afternoon ta discuss 
the FOLA process, Congressional records, and ewerythane CLIN PON-related ta FOLA/Coneressional 
inquiries, Phe known regular atiendees inchided Jonathan FINER, Chief of S151? for Secretary of State 
john KERRY, Jenniter € ae 3, Hepat Cue fof Steff, Heather HIGGINBOTTON, SE Secretary of 

















State for Mis EOY, Julia GE 13, oy 
Affairs | Ee 
Office of the Legal Adviser oversseing STAT E's BEER 
Normally, with larger FOLA requests, such as with the CLINTON-related FOLA request, IPS 
would schedule rolling release--that meant every lew weeks or monik, the properly reviewed and 
approved material would be made public. However, and The 7? Floor Group agucd Pi 
the release should be done ail at ance in January 2016, for coordination purposes. While IPS officiais did SUE 
not have control of the release process of the 296 emails related to the House Select Committee on 
Benghaat’ s request, they did have control for the release process Jor the approsimately 30,000 emails, or 
LASS pages related o the CLINTON POLS request, and mt was desided to be a rolling release. 
Om july 13. 2015, 175 on-boarded InteHigence Community Inspector General (ICIG) reviewers to 
heip with the overwhelming review process. ihe ICIG reviewers svere trained up and had. been integrated 
into the FOIA review process to help ensure I5 can meet the mandated release of all non-exempt/non- 
redacted emaila by ihe January 135, 2016 deadline. To "^: vas aware of approximately 305 can 


reierrais already sent out tor clasaificanan determunation, 


stated S/5E5 are the Custodian ot Records for al Secretaries of State and Deputy 
Secretaries of State. As such, S/ES received all taskers from the IPS team related to FOIA requests ihat 
involve Secretaries of State or Deputy Secretaries of State. S/ES skould also have answers regarding 
SLATE 8 procedures that desit with information technology, including hardware and software for STATE — 56 
empioyecs oma and iclenhanes. Joserh MACMANUS, Exocntive Secretary and Ambassador. = BS, STE 
and SESS, OY 
someone in the S/55 Information Resource Management (S/ES/AIRM) unit should know apecific m 
about CLINTON” s at-home server set-up. ene: SIATE servers were iocated at the Enterprise 
server Operations Center (250C) and Management IR M CM/LTEOVD would be knowledgeable about 
SPATE Servers. 
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. High-ranking STATE officials, described as some Assistant Secretaries and all Under Secretaries 
and higher, used a separate network for emails and record-keeping called the Principal Officer Electronic 
Management System (POEMS). The vast majority of STATE employees were not on POEMS. 


bé 


stated he heard third-hand the National Security Agency (NSA) set-up a computer for 
b7C 


CLINTON and the FBI shouid talk to S/ES about the specifics. Additionally, FBI should ask S/ES about 
Jake SULLIVAN'S email being hacked, as maybe that had sorsething to do with CLINTON’s emails or 
why the NSA set-up her computer. 
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latte River Networks, 5700 Washington Street, Denver, b6 
Colorado, 80216, telephone (303) emai dpiattenvercom. was contacted in person by ENS 
Federal Bureau af Investigation Specigi Agents ADi a 
advised of the identity of the agents identified himself a Pintte River Networks ana 
stated that he had contacted the company s legal counsel about the seheduied meeting with the FH on 
July 29 2098. Counsel had sid `` Re to answer questions fram fhe PRE withoul counse! 
present, 
S wl e interview would be necessary, however JA reeded to aR 
provide à document with instructions for Platic River Networks. invited poh SAs SS 
o àn empty conferenee room, 
SA Jprovided a copy ofa PBI preservation letter dated July 27, 2015, signed by Charles H. b6 
Katie FY, Section Chief, Counterinteligence Division. | —.— leommented companx nfiiciais had SES 
wondered how long it would take for them to be contacted about the named account, asked for 
vlariiication about the preservation letter and the responsibiiities af their company, SA then read 
rU portion of the preservation letter and explained the FRE was not asking for any information 
ai this ime, but that the letter was served m anticipation of Future legal process. Phe letter requested that 
Plate River Networks preserve any records to date which were identified in ihe aforementioned 
meservation letter. Agents alse explamied the request for non-disciosure. 
|. | expressed his concern about Platte River Networks becoming a target if this matter ever Il 
became pubiic. SA provider wib her cantact information at RBI Denver. 
| þes also provided FBI Strategic Partnership Coordinator (SPO) brochures that have me 
information about Counterimtelligence security awareness. Agents also discussed the FBI s Infrazard RS 
program, 
de Eeer, e RE, eneen EE, CERN 
E b3 
cM E ENE E b6 
b7C 
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On August 6, 2015, KATHERINE HM. TURNER, Partner at the liaw 
offices of Williams & Connolly LLP, 725 12" street, N.W. Washington, 
D.C. met at her place of employment with Agents of the FEI pursuant to 
an agreement reached by correspondence between the Department of 
Justice and Williams & Connolly. This agreement {enclosed}, reached on 
August 6, 2015, provided that Williams & Connolly voluntarily turn 
over to the FBI three (3] thumb drives containing 360,490 emails from 
Lormer Secretary of State Hillary Clinton's eciintonemail.com account 
as well as hard copy printouts of the ematis and a laptop computer 
containing a duplicate electronic copy. 


At approximately 2:20PM, TURNER met Agents at the loading dock of 

er firm and transferred 22 ilegal boxes of documents to the FBI's 

possession along with a laptop computer and three 423) Thumb drives 

escribe in detail below and on the enclosed FD-941, Consent to 
Search Computers, and FD-597, Receipt for Property. 


Item 1: Lenovo Thinkpad T420, S/N PB-YC912 12/03 


Item 2: Lexar Micro 16GB thumb drive, black and silver in color, 
S/N LTDTTi16GB-000-1001DA (original) 


item 3: Lexar Micro 8GB thumb drive, green and white in color, 
S/N LTDOTTSGB-000-317AU0 


ltem 4: Kingston 8GB thumb drive, silver in color, S/N DTSE? 


Item 5-27: 22 legal boxes containing paper copies otf the above 
described 30,490 email communications 


TURNER explained that the originai thumb drive, tem 2, was 
obtained from Platte River Networks but did mot describe how it was 
collected or under what circumstances. TURNER described the other two 
thumb drives as identical to the original though one of the drives 
contained two complete copies of the email set, The laptop computer 
was previousiy used by the firm for unrelated matters but was believed 


investigation om . OW U673013 ... ai.  Wasünelon DS eu aii See, b3 
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ot the 30,490 emails. This laptop has not been connected to the 
internet since being loaded with an electronic copy of the emails. The 
user name for tne Laptop is “.\internetoniy” and the password is 
"internetOnily!!", 


TURNER explained that the firm maintains six (6) additional 
iaptop computers, each of which contain identical digital copies of 
tne 30,490 emails, but also contain  attorney/client privileged 
communications and as such are not being turned over to the FBI at 
this time. TURNER advised her firm is in negotiations with the 
Department of Justice over the disposition of these laptops. 


Prior to departing, TURNER signed the enclosed FD-S41, Consent to 
Search Computers, and FD-597, Receipt for Property. The original was 
pt by the FRI and copies were made by TURNER for her records. 


Subsequent to the FBI's collection of the above, Items 1-27 were 
transported to the Washington Field Office of the FBI where they were 
t into evidence, and given 1B numbers. Copies of the intake 
sheets and FD-1004 are enclosed with this communication. Items 1-4 
were then transported by members of the FBI's Forensic Analysis Unit 
to Quantico, Virginia for storage and evaluation. Items 5-2 are 
presently stored in evidence control at the Washington Field Office. 
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(UFOS) On December 18, 2015 ae 
executive Secretariat ~ Informetion Resource Management Mobile Communication M SS 
MC}, st the U.S. Department of Siale, emajl address istate.gov, telephone 20 
was interviewed by Federal Bureau of investigation {FBI Special Agents 
fter being advised of the identities of the interviewing agents, and the purpose of the interview, 
provided the following Information: — 
juypereL ke worked at the Department af State since | þa has heid a variety of Ae 
iT related positions that include mobile computing, network engineermy and develoniny the Stz SZ 
Messaging and Archive Retrieval Toolset (SMA ien 
aes, 
(LUPE Ge) The MC team Is responsible for establishing secure mobile voice and data 
communications for the Secretary of State (Secretary) and his tearn when they are traveling domestically 
and internationally. Prior to a trip by the Secretary and his team, the MC team assembles kits of 
networking equipment at their lab in Springfield, VÀ, The Kits include networking components such as 
switches, routers, encrypters, laptops and VQIP phones and ere custamized based on threat stream 
information provided by the local Regional Security Officer. The equipment is then tested to ensure that 
itis working property and that ti hasnt been compromised before being scaled in a diplomatic pouch and 
sent to the US. diplomatic establishment at their destination, Upon arriving onsite, the team collects the 
pouch and checks that the seals havent been tampered with. eegen ided that there are nine kits SS 
C 


of networking equipment and that multiple kits are deployed when the Secretary is traveling to multiple 
locations on a single trip. 
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(URRH The communication networks established by the MC team provide the Secretary and 
his staff with secure data and voice connections, so that they can connect back to the Department of State b6 
network to securely conduct official business. Although the networks established by the MC team create bic 
encrypted e channels, users are stHÍ required to use a fab to access their Department of State email 


accounts. oted that the MC team continuously manitars the network encrypters to watch for 
any signs of an intrusion or other compromise of the system. 


(ugoe ` provided that the Secretary and his team typically do not use the SRU bé 
network established by the MC team for personal matters, He noted that they are free to use the standard 
internet service in their own room, as any other hote! guest would. 


BTC 


bl per DOS 





qcuments, or facsimiles, are sent for the Secretary to review they arc usually delivere 
to the MC team by the local U.S. diplomatic establishment. The MC team then reviews the classification 
matkines and page count before providing the document to the recipient. Once the review is complete the 
MC team collects the document, counts the pages and then enters the event inte a lag. 


(FEO) if an urgent message arrives at the mobile command post for the Secretary or his team 
the MC team will alert the recipient that a message has arrived and that the recipient should return to the 


command center, Depending on the Secretary’s location, this might mean sending a message to one of his 
Line Assistants or knocking on his door if it ts after hours. tated that the Secretary does not b6 
have a secure cell phone and that he is typically notified to retum to the mobile command center even pc 
though there are usually secure communications in his car. 
(Uu/EOco] —— [ated that the MC team’s policies and procedures are the same for SS 
E 


domestic travel as for mlernational travel, However, in the case of domestic travel the communicalton 
kits are sent via Diplomatic Security instead of via the local US. diplomatic establishment. 
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(UFOO Fhe MC team is typically staffed by two to four MC team members, depending on the 


On 12/21/2015 , Page 





site, AH of the MC team members hold à TS/SCI clearance and receive extensive training on the 


equipment and security procedures before their first deployment. The MC team members are from various 
components within the Department of State and may be contractors, Foreign Service members, or career 
civil servants. The average team member is on the team for tw 


I assi ithin the Department of State. However, 
yas been on the MC team for approximate! 
(UFOO as not i a position to comment on how the MC policies and procedures 


had changed between 2009 and today but he noted that they are constantly working to apply faster and 
—, that wiil achieve their mission of prov ding | secure and reliable communications. 


ad no cor 


tha et aana 
CZ, be able to provide more insight on how the MC team operated between 2009 and 
UES. 
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(LEO) A copy of the original interview notes are attached in a LA envelope. 
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was interviewed bé 


(U/FOUO) On June 21, 2016 
| b7C 


by Federal Investigation (FBI) Special Agents 


residence, r5 VA. After being advised of the identities of the interviewing agents, 


and the purpose of the interview | |provided the following information: 









(UO | [worked a JS Department of State (DOS) for in| hor before Eë 
i telecommunications specialist under the Executive Secretariat me 
(S/ES) at DOS during HILLARY CLINTON’s tenure as the Secretary of State. KE that his daily 

duties remained the same during this period despite several reorganizations which moved his position to 

different departments. He was responsible for supporting the installation and operation of secure 

communication equipment at DOS. This included secure video, secure voice, the Washfax, as well as 

regular telephone and facsimile supe fe not responsible for email support, which was the 


f S/ES — Infonnation Resource Management (S/ES— E. tof |] 
Å was H F ES-IRM under JOHN EL 
quise) — supported CLINTON 's transition to DOS and was responsible for establishing b6 
secure communications in her office, vehicles and residences, He initially conducted a survey at each b7C 
residence to identify where the commercially provided telecom service entered the residence (i.e., the 
“point of presence”) and to assess what equipment needed to be installed. Thereafter connected a T1 
ircuit and ran lines to the locations in the residences,where the equipment would be instalied. Although 
| installed the equipment it was sometimes maintained by other departments within DOS. For example 
maintained the Defense Red Switch telephones (i.e., red phones) once they had been installed by 
The point of presence in the Whitehaven residence was in the basement an ran lines from 
there to closet in the third floor SCIF. He then dropped additional lines to the second floor office area so 
that an additional STE and red phone could be installed. Similarly, the point of presence at the Chappaqua 
residence was also in the basement ul "Ee lines to a small luggage closet and then to the final 
equipment locations within the residence. 


(U/FOLR) During the tapsition| — lwas also tasked to research the feasibility of obtaining a b6 
secure BlackBerry for CLINTON as directed to do this by a combination of the followiog people: BIC 


DAN SMITH (Executive Secretary), LEWIS LUKENS (Deputy Assistant Secretar En BENTEL 
(S/ES-IRM Director), and the "EES Center Director who was eithe 


| wd 
investigation on. 6/21/2016 at | |va | e La 
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at the time. DOS wanted to assess the feasibility of using secure BlackBerry phones because 
CLINTON and her staff were BlackBerry users so DOS wanted to provide them with resources that they 
were familiar with. However, after conducting his assessment found that the secure BlackBerry 
phones would require an entirely new infrastructure, which was cost prohibitive; and the actual devices 
_ Were too thick. ` l l 


tee) kwas shown an email with the subject “State Department Telephone Services at 
Secretary Clinton’s Residence” that he sent to LUKENS and ABEDIN on January 27, 2009. The email 
summarized the telecom equipment that was installed at the Whitehaven residence. After reviewing the 
email, xplained that “CMS VoIP” line referred to the direct phone line to the White House and that 
the "IST/Red Switch" was a red phone that was installed as a backup to the CMS VoIP line. The 
"Business Lines" and "Ops Dedicated Drop" were standard phone GT ku that not all of the 
led equipment belonged to DOS and noted that the CMS VoIP system belonged to the White House. 
m=? he did this in an effort to give the Secretary the most reliable equipment but this approach 
caused some strife within DOS. 


uireseL 1] from S/ES-IRM, was responsible for installing and 


managing CLINTON’s computer systems at the residences oordinated his installation activities 
with S/ES-IRM and typicaliy did not conduct hts work when they were on site in effort to avoid flooding 
the residence with people. 


| tool ` Jun show i) with the subject “Secretar Residential Installation 
awash” that he sent to BENTEL el Je March 17, 2009. . 
explatned that a hotwas onducted to develop a solution for any technical problems they had or 


complaints that they dead ` Dad that they had significant issues with the unclassified telephone 
lines at the residence in Chappaqua. He attributed this to the number of service providers that a direct line 
traversed as it connected Washington and Chappaqua. As a result the lines consistently had bad 
connections. Additionally, the red phone on the second floor in Chappaqua did not function properly and 
eventually CLINTON directly. ud remove the gend ` baie! that he removed the phone but 
it created some internal issues for him as the phone was maintained by IRM and not proup. 


uutotuel ` kbate that the “Server: Basement Telephone Closet,” as listed in the attachment 
to the aforementioned "Secretary Residential Installation Hotwash" email, referred to the point of 
presence for the telephone system in Chappaqua and was not a reference to a computer server. Was 
aware that there was an email server in the Chappaqua residence. However, he believed it was Tor the 
CLINTON's family email and he did not realize that CLINTON was using the server for DOS business. 


(wiFese] kond not recall when he first learned that CLINTON was using a private email 
account but stated that it was sometime during her tenure. He did not think that CLINTON’s use of a 
private ema unt Was odd because COLIN POWELL had a private email account that he accessed 
from DOS. lso assumed CLINTON had a DOS issued account. lid not communicate directly 
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with CLINTON on email and instead worked through HUMA ABEDIN when necessay| — liid not 
recall anybody ever expressing concern over CLINTON's server or email, but noted that he did not attend 
the S/ES-IRM meetings were such topics would likely have be discussed. 


(U//FOUO) A copy of the original interview notes and referenced documents are attached in a 1A 


envelope. 
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(U//FOUO) On May 12, 2016 „was interviewed by Federal Bureau of 


Investigation (FBI) Special Agents in room 374 at the 
Eisenhower Office Building pens anii Avenue ^ ashington, DC 20502. Also b6 


— BIC 
present el ` ke A attorney a 

Department of Justice attorne fF 1] After being advised of the identities of the interviewing 

agents, and the purpose of the intervie Loo i provided the following information: 










(U/ is currently employed as bef Žž Jat the National 
Security Council. has held a Top Secret/Sensitive Compartmented Information (TS/SCT) 
learance since 2003 when he was originally sponsored by the Central Intelligence Agency (CIA). 
mm: not,.nor has he ever Teen, an Original Classification Authority (OCA). In ^! NN b6 
egan a fellowship at the Denartm: State (DOS) in the South Asia Bureau. After moving to tbe Iran p7C 
desk for a few weeks 1 for the Special 
Representative for Afghanistan and Pakistan (SRAP). While at the SRAP Se worked for |. 


PAUL JONES, FRANK RUGGIERO, MARC GROSSMAN and RIC 
. remained working for the SRAP unti when he moved tc 












(U//FOUCO) While he worked at t was unaware of how information flowed to 
Secretary of State HILLARY CLINTON. was generally aware that the Executive Secretariat at 
the DOS was responsible for information flow to the Secretary of State old not say who 56 
communicated or emailed with CLINTON did not email or communicate with CLINTON Pre 
directly and did not know that CLINTON had a private email address hosted on a private server until he 
was made aware via various media outlets in March 2015. 


(u/Foue| — ]was assigned official DOS email m on both an unclassified network 


and the Secret Internet Protocol Router Network (SIPRNet) did not have a Joint Worldwide 


Intelligence Communications System (JWICS) email account that he could access in his office, but was 
— 


aware that he was issued one by the Bureau of Intelligence and Research (INR) at the DOS. 
b7C 


el used his JWICS account because his work did not necessitate it and it was hard to 


. access jl] any specific DOS training pertaining to official email usage guidelines, 
policies or practices. tated “obviously classified information goes on classified systems." 
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(U// roseo] lue Principal's Committee (PC) meetings were initiated by the National 
Security Advisor via official notice to government agencies. The PC meetings would involve participating 
government agencies presenting their policy on topics prescribed by the National Security Advisor. A 
Deputy's Committee (DC) meeting would involve the same process although convened by the Deputy 
National Security Advisor. Dd ius at the DOS, he recalled weekly DC meetings related 


to Afghanistan and Pakistan issues. While in the SRAP office, ould contribute to packages 
assembled for DC and PC meetings. Usually, the Deputy SRAP would assign various taskings for a 
policy paper to be used in a DC or PC. Within the SRAP office stated there was no science as it 


related to who was assigned work. The assignments could be based on your area of expertise or who you 
knew within DOS. was unaware of any formal process when.collaborating, drafting, editing or 
publishing a written product with another bureau or office at the DOS. 







| as unaware of the term "upclass" as s it referred to the classification of a 
roduct did: not know how classification of a written product was ultimately decided. 
[T keet seeing written product with suggested classification markings and he would always 
ere io those by appropriately marking the same information carried over to his products or edits. 
| mm portion ings at the DOS were uncommon before WikiLeaks released classified DOS 
cables on their websit understood the classification process to “happen organically” and to be 
“more pr an art than a science." | 


(U//FO9) At this point in athe interview, Agents —. documents and emails concerning a 
October 5, 2009 PC meeting involving the en provided the following information: 


(ureeso] —  lecatea the general topic of the October 5, 2009 PC meeting, but did not 
recall the exact meeting or any of the displayed documents. stated there were many PC and DC 
meetings regarding Pakistan and Afghanistan policy in 2009. did not recall drafting or editing 
any portion of the briefing paper or the geen —— fn not recall who drafted any of the 
briefing paper or the attachments. When shown metadata indicatin rafted the attachments 
associated with the foregoing briefing paper ed the metadata inferred he interacted with the 
attachments, or possibly saved them at one point, bu did not recall doing so. 

(u/Fewe)|  lescribea the| —— feport as the result of a review of Afghanistan and 
. Pakistan e tend STANLEY MCCHRYSTAL. The report resulted in a request for a 


troop surge in the area recalled there bei sified version of th report released and 
then shortly after, an unclassified version released elieved it was standar m to have both 






classified and unclassified versions of a document released around the same time escribed the 
report as relevant one day. then shortly after, irrelevant. During his tenure at the BEEN: 
not recall ever reading the eport. 


ipoe m recalled having no concerns over classification or mishandling of documents 
while at the DOS. 
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(U/FEBA) On January 29, 2016 ua 
interviewed by Federal Bureau of Investigation (FBI) Special Agent 
a Starbucks Cafe, 3707" Ave, New York, NY 10001. Representin and also 
present for the interview, was Attorney at Law, telephone (202 After being 
advised of the identities of the interviewing agents and the purpose of the interview 
provided the following information: | 
joined the Department o stant for 
Thereafter she became th under s 
JAKE SULLIVAN. left the DoS i to work for th 
urouso) provided that as a Special Assistant at DoS she was a political 
appointee. Upon starting at DoS she was sworn in and then received the standard on-boarding and b6 
security trainings. However, could not recall any specific training about the Freedom of b7C 
Information Act (FOIA) or the Federal Records Act. 
(UFOS) aveled with CLINTON and had no knowledge of her iPad or 
other devices that she used. did not have direct contact with CLINTON while she was at’ 
DoS and did not email directly with her until after she had left ps[ Aen that CLINTON b6 


"was using a personal email account but did not know that it was a potenttal issue until she read about it in p7C 
the NEN unaware of an official policy at DoS regarding the use of personal email 
accounts and recalled that other people on CLEINTON’s staff would use their personal emails periodically. 


(ese) d learance while at DoS and received training on the | b6 
handling of classified information. routinely handled classified information on the b7C 


but did not know how such information was transferred from SULLIVAN or 
o CLINTON. 


(U//FeHe) ZFS is at i Läb? ion (L t was established for the Office of 
Hillary Rodham Clinton, by | , ua 


(U//FOUO) When iginally joined th i 
based in Washington, D.C. a The office then moved to New YorK City 1 b6 
b7C 
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Ch was primarily responsible for arranging phone calls, drafting memos and summarizing news 
articles. She was later promoted to th rovided the names and 
positions of the following individuals who during 
that time period: | | 


e HUMA ABEDIN - Chief of Staff | 
e MONICA HANLEY — Personal Assistant 





V] Platte River Networks port to the 
trequently spoke with from PRN, 
about routine matters such as purchasing laptops and maintaining the IT systems. 









ad no recollection of ever receiving a laptop from PRN or 

spoke. with HANLEY regarding this matter approximately one month ago 
ier email records to see if she had any further information about the laptop. 

ound one email between her and HANLEY in which they discu sending the laptop to 


. However, the discussion transitioned trom email to phone an ad no further 
recollection on what occurred. noted that this occurred during the period when everybody 
was working from home due to the aforementioned lease issue, T if the laptop was shipped to her 


she would have had it sent to her apartment. She further noted tha was responsible for opening 
the mail for the office but that he would not have opened anything directed to | 
speculated that perhaps it was shipped to the Clinton Foundation in New York City but she did not know 
what they would have done with it. | 


Deeg, ml no recollection of CL ails being turned over to DoS. 
Nor was she involved in the culling of CLINTON’s emails had no knowledge of any 


* archives of CLINTON's emails aside from the laptop in question. 
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(U//F&89) Following the interview reed to provide the above referenced email 
chain with PRN to the FBI. On February 3, counsel electronically provided the 


email to S; 


(U//FG39) A copy of the original interview notes and the email provided b be 
attached in a 1A envelope. | 
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to the Inspector General, United States PES of State, Office b6 
b7C 





Agents and the nature of Ge ett — Tn [provided the following information: 


In early March 2015, the New York Times published an article about Secretary Clinton's personal 
email account while at the Department of State. The article alleged Secretary Clinton used a personal 
email account to conduct official government business in violation of federal laws. Sometime thereafter, 
John KERRY, Secretary of State, sent STATE IG a letter requesting a review of email and records 
management at the Department of State. On or about March 12, 2015, STATE IG and Office of the 
Inspector General of the Intelligence Community (ICIG) received letters from Congress requesting a 
review of State Department employees’ use of persona! email for official purposes and coordination with 
relevant agencies to determine whether classified information was transmitted or received by State 
Department employees over personal systems. 


STATE IG initiated a review of the use of personal communications hardware and software by 
five Secretaries of State and their immediate staffs. The review went as far back as former Secretary 
Madeleine ALBRIGHT. In Fall 2014, the Department of State wrote to the last four Secretaries of State 
asking whether they had any official email in their personal records. The Department of State issued 
preservation requests, asking each former Secretary to preserve all electronic data they had while at the 
Department of State. Secretary Colin POWELL responded that he used an America on Line (AOL) 
account. Secretary ALBRIGHT reported that she did not have personal accounts with official records. 
Secretary Condoleezza RICE reported having a Gmail account, which she did not use for official 
purposes. 


In response to the preservation request, Secretary Clinton’s attomey, David KENDALL wrote a 
letter to STATE IG stating Williams & Connolly, LLP was in possession of three thumb drives with 
secretary Clinton’s email from her private network. KENDALL and Katherine TURNER were the only 
people at the finn with access to the thumb drives. The letter further stated Platte River Networks was in 
possession of the server and had been made aware of the preservation request. 
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In December 2014, Williams & Connolly, LLP produced twelve boxes, approximately fifty five b7C 

thousand pages of about thirty thousand emails to the Department of State from Secretary Clinton’s 

private server. There is a court order in place, which requires all thirty thousand emails to be released by 

January 30, 2016. The emails have to be released on a monthly basis. The emails are released based on 

select percentages. Thus far, two waves of Secretary Clinton’s emails have been released on the FOIA 

website. Department of State had about fifty to sixty people working on Secretary Clinton’s emails for the 

FOIA review process. 


Upon receipt of the emails, they were scanned, entered to the OCR process and then uploaded to 
Department’s of State ClassNet system, which was classified up to SECRET. The emails were then 
divided into sub-groups. Then each email went through the FOIA process to determine the appropriate 
FOIA exemptions, if any. Ultimately, the emails were publicly released. Initially, senior State Department 
officials were being used to review the emails. The officials would review the email, identify which State 
Department equity worked on the information, and would then send the email to that department. The 
receiving department would then identify certain exemptions and/or send to other agencies, if other 
agency equities were involved. The emails would come back to Department of State for further review ` 
and were ultimately reviewed on the FOTA website. The B (1) exemption was used to protect sensitive 
Department of State equities. B (5) exemptions were used to redact internal deliberations. B (6) 
exemptions were used to redact Personally Identifiable Information (PII). 


STATE IG brought in ICIG to assist with the identification of classified information and to take a look 
at the FOIA review process [ftom ICIG reviewed Department of STATE’s FOLA b6 
review brought broader experience to Department of State's assembly line review b7C 
process. uickly determined Department of State needed to make some changes to their review 


process. On or about June 19, 2015 STATE IG and ICIG jointly made four recommendations to the State 
Department related to the FOIA review process. The recommendations were as follows: 


i. Recommend State Department FOIA office request staff support from IC FOIA offices to assist in 
the identification of intelligence community equities; | 

2. Recommend IC FOIA officers review the emails to ensure that ClassNet use is appropriate before 
transmitting to the State Bureaus for review; 

3. Recommend State Department FOIA seek classification expertise from the ZE to actas a 
final arbiter if there is a question regarding potentially classified materials; and 

4. Recommend State Department FOIA Office incorporate the Department of Justice into the FOTA 
process to ensure the legal sufficiency review of the FOIA exemptions and redactions. 


Patrick KENNEDY, Under Secretary for Management, U.S. Department of State was a key figure in 
all of this. KENNEDY accepted FOIA recommendations number one and three on behalf of the 
Department of State. During a July 2015 meeting with STATE IG and KENNEDY, KENNEDY said 
something to the effect “We sent our folks from Diplomatic Security (DS) to conduct a security 
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assessment of Williams & Connolly". DS concluded Williams & Connolly had procedures in place to bic 
secure the three thumb drives. KENNEDY mentioned Williams & Connolly handled the General Petreaus 
investigation, so they had the appropriate clearances and were safe. STATE IG left that meeting with the 
impression that Department of State had an electronic copy of Secretary Clinton’s emails. Later, STATE 

IG was told that Department of State did not have an electronic copy. STATE IG still would like to obtain 

an electronic copy of the thumb drives. 





STATE IG’s review focused on the following areas: 


1) Preservation of Records 
a. Are records being preserved for archival purposes? 
b. Are appropriate systems in place for Freedom of Information Act (FOIA) purported? 
c. Are records being kept in line with the Federal Records Act? 
2) On-Boarding Process 
a. How are methods of communications established for new Secretaries? 
b. Each Secretary may like various devices, how does Department of State make those devices 
secure for usage at Department of State? 
c. How had Department of State addressed security issues? 
d. How did State Department set up secure phone line at Sécretary Clinton's house? 
e. What precautions were in place for personal devices? 
3) Records Creation Designation 
a. How does State Department bs sure draft documents get captured in Department of State's 
records retrieval process? 
4) How has Department of State handled FOIA and the Congressional Process? 


p6 


opined Department of State's record keeping process was not good. Prior to the last couple Dua 


of years, record keeping was done on a print and file basis. Literally, if someone wanted something to be 
kept as an official file, that person would have to print the document and request another person file it 
away. STATE IG was in the process of taking a deep dive into the on-boarding process of Secretary 
Clinton’s server. 


Secretary Clinton preferred to use Blackberries. In fact, she had at least two email accounts that 
- went directly to her blackberry account was not sure whether Secretary Clinton had an 
Information Technology (1T) infrastructure from her time in the U.S. Senate or her presidential campaign. 
Bryan PAGLIANO worked in IT support for Secretary Clinton's campaign. Shortly after Secretary 
Clinton started her tenure at Department of State, PAGLIANO was hired as a Schedule C, directly 
reporting to Secretary Clinton. PAGLIANO set up Secretary Clinton's personal server and provided her 
direct IT support. PAGLIANO left the Department of State sometime in 2013 and came back in early 
2015 as a contractor. STATE IG contacted PAGLIANO as part of STATE IG's ongoing review. STATE 
IG was informed PAGLIANO was represented by attorneys from Akin Gump Straus Hauer & Feld, LLP. 


b6 
b7C 
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PAGLIANO refused to talk without being granted immunity from prosecution. BIC 
Secretary Clinton had at least two AT&T blackberry accounts. The first account was the HR15 
email account. In September 2013, there was an article about Sydney BLUMENTHAL having his email 
account hacked. Apparently Secretary Clinton's HR15 account was cited in that article. As a result, 
Secretary Clinton changed her email to HRD14. : 
believed that Secretary Clinton's server at some point was held at her Chappaqua quA 


residence. Departme e would send an advance team to set up Secretary Clinton's communications 
wherever she needed did not know who paid for the server. Huma ABEDIN and Cheryl MILLS 
were the conduits for contacting Secretary Clinton. Only a few people at the Department of State were 


able to contact Secretary Clinton directly. bé 


bic 
As part of STATE IG's ongoing review] 


1) b5 per DOS 
2) 
3) 


ecommended the E k to PAGLIANO] — — | and [wo were all i " 
Department of State employees was willing to provide the FBI with assistance as necessary. 
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) On June 3, 2016, Department of State (DoS b6 
l jewed by Federal Bureau of Investigation (FBI DIC 
in his office located at 
Virginia. er being advised of the identities of the interviewing agents, and the purpose of the 
wel es the following information: "ow 
I Lom during the tenure of fo ecretarv of State CONDOLEEZZA RI ST 
ILLARY R. CLINTON at ms] `` ` ke recently reported tof | 
wreve[__— 7 
(IT) Operations for DoS. This included, but was not limited to, software applications, hardware, DIC 
telecommunications, email ` Wie Information Resource Management (IRM). . 
uewe Jerovädeg IT briefings to CLINTON’s transition team upon their b6 
arrival, however, the DoS executive office did not fall unde responsibility. JOHN bIC 
BENTEL. who oversaw Executive Secretariat Information Resource Management (S/ES- IRM), would 
have ee in regards to managing IT programs for executive management. 
(U//FO8UO9) Around the time of CLIN board transition, PATRICK KENNEDY, Under 
Secretary of State for Management, suggested interview BRYAN PAGLIANO, who b6 
served on CLINTON’s 2012 Presidential Campaign. interviewed b7C 
o had a MBA from the Universit er interviewing PAGLIANO, 
greed he would be a good fit for eam. PAGLIANO was 
subsequently hired on to DoS in a Schedule C position, and was tasked with assisting mainly with cost 
recovery planning and researching DoS technical enhancement opportunities. 
ure ]| was not aware PAGLIANO had a secondary role of providing ` b6 
technical assistance to CLINTON. Althoug was aware PAGLIANO came trom DIC 
CLINTON's campaign, he noted PAGLIANO did not have any overtly apparent ties to the 7" floor [a 
reference to whe N's executive suite was located at os he recalled one 
incident a ie dealing with a matter that needed input irom the 7" floor, and 
PAGLIANO mentioned he occasionally had contact with individuals on the 7^ floor. PAGLIANO 
E | | b6 
! b7C 
Investigation on, — 6/3/2016 | at | La. D3 
" — Date dictated N/A mie 
| wA 
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offered to reach out to his 7” floor contacts, bul ismissed the offer and proceeded 
through regular channels. As a Schedule C hire, PAGLIANO would have been required to report any 
additional income he received from side work with CLINTON. 


(uupetael was not aware of, nor did he have any discussions with PAGLIANO 
concerning CLINTON’s use of a private email account or email server. TT" not have 
direct correspondence with CLINTON, and learned of her use of a private email server when he read 


about it in the New York Times. 


(U/FOU8)t wa] [understanding that DoS policy “discourages” the use of 


private email, but does not prohibit it. 


(ureno has not aware of the specific IT setup in either CLINTON’s office or 
ed both of CLINTON's — e a DoS Secure Fax 
ledio 







was assigned t “help desk," and _| worked fo but later went to work on 
the 7^ Hoor, 





techtieian who wold kummer who installed I DoS évitant at the n S Bees | 


(U//FOUO) The Gate Messaging and Archival Retrieval Toolset (SMART) records management 
system was implemented by IRM as a result of recommendations from a DoS Executive Steering 
Committee. SMART replaced s telegraph system, and was developed to automate / streamline the 
process for archiving records. was involved in discussions about the development and 
rollout of SMART, as were representatives from SES. Representatives from the Executive Secretariat 
asked to be the last to rece] ollout. However, ultimately SMART was never rolled out to 
the Executive Secretariat. could not recall exactly when SMART was implemented at 
DoS, however, he assessed SMART was rolled out sometime in 2007 - 2008. 


(U//FG9O) A copy of the original interview notes are attached in a 1A envelope. 
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at his residence MD. After being 


advised of the identities of the interviewing agents, and the purpose of the interview rovided the 
following information: 
CURRO az served as t the Department 


of State (DoS) from the beginning of KERRY’s tenure to Prior to joining Dos, 
| _ kerved as mmm hen KERRY was the Chairman of the Senate Foreign 


Relations Committee. 


(U//FO3G) A lot of information would flow throu d "E route to KERRY, to include 
information concerning Congressional Oversight. as tangentially inyc In the process of 
production of DoS records to the Benghazi Committee, in that KERRY aske to ensure the 
Committee did not face any DoS roadblocks in response to the request. Furthermore wanted to 
make.certain DoS was as comprehensive as possible in their response to the Committee’s request 
was primarily concerned with KERRY being questioned by the Committee over the totality of the 
production, and thus wanted to cover every production avenue possible to avoid KERRY being blindsided 
if called to testify to the Committee, The production of documents related to Benghazi began in the 
spring ( April/May) of 2013 and continued as a "rolling production." 







(U//FOUOO was not aware former Secretary of State HILLARY R. CLINTON was using a 
private email account until 2013, when he recalled hearing news of her email account potentially being 


compromised as a result of a hack into Sidney Blumenthal's email account. dvised KERR Y to 


use a government email account when he became Secretary of State, despite what previous Secretary's 
may have chosen to do| ko not aware until recently that CLINTON"'s private email account was 


maintained on a private server. 
LUFO) called sl — production documents containing CLINTON's 


personal email beginming in early 2014 did not recall having any concerns after seeing that 
CLINTON used a personal email account, as he was aware other Secretary’s of State had done the same. 
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(U//FOO) In August or September of2014| ^ |wentto Capitol Hill to meet with the staff 
members of the Benghazi Committee, in preparation for a pending hearing with KERRY recalled 
the topic of issue in his meeting with the committee staff surrounded inquiries regarding the preservation 
of records, Following his meeting with the committee staff. contacted CHERYL MILLS to advise b6 


of possible leaks from the committee referencing their production concerns related to 
ne phone conversation with MILLS concerning the matter. 
wl from a Public Affairs perspective. 


some visibility in the matter, as 


(U//FO489) In approximately December of 2014] f| recalled a large number of printed 
CLINTON emails being dropped off at DoS. as surprised at the volume of emails produced 


ed the production to be close to ages. Two attorneys fro 
ast Name Unknown (LNUJ) and LNU [believed to be a reference t 


were brought onto DoS to and coordinate the redactions im regards to b6 
Benghazi FOIA es ~~ ce someone who would be “encyclopedic” b7C 
concerning the process of production regarding Benghazi, to include the production of CLINTON’s 
email. DoS was also involved with the DoS production and 
review process as it pertained to CLINTON's emails and Benghazi as a whole. PATRICK KENNEDY, 


DoS Under Secretary for. Management, also had insight into the production process. 


INTON's email. DIC 




















(U//FO06) During the course of the Benghazi production, DoS recognized there was a gap in 
records related to emails pertaining to not only CLINTON, but other former Secretaries of State who did 
not use DoS email accounts. As such, Executive Secretary JOSEPH McMANUS drafted a letter in 
October 2014, requesting former Secretaries produce any personal emails responsive to the Federal 
Records Act in attempt to retroactively address the gap in DoS records. 

(UA was not involved with the discussions or the process concerning how the | = 
did not provide direction on how the emails should be 
produced, nor did he have any knowled at methodology was used in determining what emails 
were responsive to production requests. was unaware of any concems that the original production 
of emails provided by CLINTON was not entirely comprehensive in response to the request, nor was he 
aware of any concerns that the email production might contain classified material. à 


email production was conducted. 


(U//FEG8) A copy of the original interview notes are attached in a 1À envelope. 
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b3 per ODNI 

bé per FBI 
" b7C per FBI 

uroo 1] date of bim ë was interviewed at the 

Office ei the er General of the Intelligence Community, Patriot Park, 1229 rise Valle D 
Resto 91. Also present during the interview were | 
— After being advised of the identity of the interviewing Agents and the nature of 
the interview, = E rovided the SEE information: BS ear OBR 
b6. per FBI 


d (S@xP[ "ka worked as an Inspector in the Office of the Inspector General of (he Lac per FBI 
Intelligence Community (IC/IG) for approximately 2 years. In May 2015, IG/IC began to assist in the 
Department of State's Inspector General's (STATE/IG) review entitled “Use of Personal Communications 
Hardware and Software by Five Secretaries of State and Their Immediate Staffs." This assistance was 
requested pursuant to the March 12, 2015 letter from the United States Senate. 









Dit On or about May 28 ml el met wit e 
Inspector General, United States Department of State (STATE) and other STATE employees in order to 
assist in completing the review. It appeared that STATE Freedom of Information Act (FOIA) employees 
were at least already 6 weeks into the review lot recognized problems that 
impeded STATE’s review process. Some of the problems were 1) STATE’s computer software was at 
least 2 generations behind; 2) the optical character recognition (OCR) was faulty; and 3) STATE e Ges 2 
employees used initials to describe organizations, as opposed to using intelligence designations. Luc 5er rar 

[found STATE FOIA employees very helpful. On various occasions many of the FOIA officials 
stayed after midnight to conduct the email review. 


U OAA On or about May 22, 2015, STATE publicly released two hundred ninety-six e-mails 
belonging to former Secretary of State Hilary Clinton (CLINTON). The two hundred ninety-six e-mails 
were previously reviewed and released by STATE FOIA officials in response to previous FOIA requests. 
According to the Defense Intelligence Agency, National Security Agency, and National Geospatial 
Intelligence Agency officials, at least one of those un-redacted e-mails should have been treated as 
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- classified. On or about June 25, 2015 the IC/IG notified the Director of National Intelligence and x d ES 
members of the senate of this leak of classified information. e 


U | YF) IC/IG believed that the release of the two hundred ninety-six e-mails did not comply with 
FOIA regulations. In fact, public figures were completely redacted from the TO, FROM and CC lines, in 
violation of FOIA regulations. ft also appeared that no STATE FOIA personnel knew how the two 
hundred ninety-six e-mails had been selected to be released. STATE FOIA personnel indicated during the 
FOIA review process, some B1 (Classified National i ormation) were removed and changed to 
B5 FOIA exemptions (Privileged ei  — Ce STATE FOIA redactions ofp3 per ODNI 
classified information were inappropnately designated or changed. b6 per FBI 
b7C per FBI 
Ui (ASE) The two hundred ninety-six emails were taken from approximately fifty-five thousand 
pages of thirty thousand e-mails provided to STATE by the Law Offices of Williams & Connolly LLP, 
(William & Connolly) CLINTON’s personal counsel. According to Williams & Connolly, the firm had 
provided all of CLINTON’s work related or potentially work related e-mails from her @clintonemail.com 
account. Williams & Connolly also maintained a copy of the .PST file containing the electronic copy of 
the above referenced e-mails, on a thumb drive, stored in a secure safe at Williams & Connolly's 
Washington, DC office. David Kendall (KENDALL) and Kathertne Turner, Esq. (TURNER) were the 
only two people that had access to the thumb drive. The firm further advised they believed the server 
equipment used to host CLINTON’s @clintonemail.com account was no longer valid or active. Platte 
River Networks in Colorado maintained custody of the equipment and had received preservation notices. 


T OA IC/IG had considered serving legal process to Williams & Connolly in order to retrieve 

the thumb drive. Diplomatic Security had attempted to retrieve the thumb drive from William & 

Connolly, but were informed that since the firm had received preservation le -the .PST files, the 

firm could not release the thumb drive to Dtplomatic Security. According to mmm b3 per ODNI 

Security was led to believe Williams & Connolly in fact had 3 copies of the thumb drive. b6 per FBI 

b7C per FBI 

U| (SRF) In December 2014, Williams & Connolly informed STATE they had fourteen boxes 

coniauing the approximately thirty thousand e-mails. However, when STATE officials arrived to pick up 

the boxes, STATE only received twelve boxes. IC/IG had no information as to whether Williams & 

Connolly were authorized to store classified information or if KENDALL and TURNER held security 


clearances. 
b3 per ODNI 


T tse urmiseol Jan ner STATE FAs e8 Per PPr 
pici | poi : b7C per FBI 

Were SUSPICIOUS O A | egislative Affairs of atto meys 

(Che ee a AAAA TEET 

involvement o 


made recommendations and re 


3 I ted additi ges that were not routine. MENN and ` 
both previously had worked at which appeared to create a conflict of interest. 


Hume, o umm 
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| elieved both attorneys had also worked at th and was possibly, .. per ODNI 
involved in the Lois Lerner, Internal Revenue Service situation. | b6 per FBI 


p7C per FBI 


(U//FORO) On or about June 15, 2015 IC/IG sent a letter to STATE/IG documenting potential issues 
identified in the Preliminary Review of the State Department FOIA Process. The recommendations were: 


I. Recommend State Department FOIA office request staff support from IC FOIA offices to assist in 
the identification of intelligence community equities: 

2. Recommend IC FOIA officers review the email to ensure that ClassNet use is appropriate before 
transmitting to the State Bureaus for review; 

3. Recommend State Department FOIA seek classification expertise from the interagency to act as a 
final arbiter if there is a question regarding potentially classified materials; 

4. Recommend State Department FOIA Office incorporate the Department of Justice into the FOIA 


process to ensure the legal sufficiency review of the FOIA exemptions and redactions; »3 per ODNI 
| b6 per FBI 


IUIZS#NF) On or about June = e 2 15, a review of the thirty thousand e-mails revealed five Fi per FBI 


additional classified e-mails. used key word searches in order to review the e-mail. It appeared 
that one in every five e-mail addresses were not a .GOV e-mail address. In the thirty thousand e-mails 
there were about seventeen unsigned classification upgrade memorandums. These memorandums were 
packages of information which were being held for the Assistant Secretary of State for Administration’s 
signature. 


USAF) On or about July 1, 2015, IC/IG officials met with Patrick Kennedy, Under Secretary of State 
for Management and other STATE representatives. IC/IG informed STATE m S assist 43 per ODNI 
STATE/IG conduct the review, whether or not STATE welcomed IC/IG's input lleged 6 per FBI 
STATE made several misrepresentations during this meeting. One such statement made by STATE’s b7c per FBI 
legal counsel was “there were no classified information contained in the thirty thousand e-mails”. 

| b3 per ODNI 


| was willing to assist the FBI further as needed. | | b6 per FBI 
b7C per FBI 
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United 
State ent of State, Office of Inspector GeneraL(S Virginia Avenue, NW, Suite e 
Washington, D.C. 20037, telephone (202 j ğstate.gov, date of birth e 
was interviewed in person by FBI Special Agents 
her office. After being advised of the identities of the interviewing Agents and the nature o 
interview, mmm keet the following information: 







beg [ E 1G in as 
In he became Evaluations 
and Special Projects unit, which consisted of approximately 10 people from both STATE IG and the b6 
Intelligence Community Inspector General (ICIG). worked on Congressional requests BAG 
and other special inquiries that are handled by STATE 1G, which included a special project related to the 
Freedom of Information Act (FOIA) process as a whole. 


ta IG were in the process of conducting a review at STATE, focused on b6 
three main areas. Those areas were how 1} STATE records are preserved; 2) how STATE employees SZ 
handled the FOIA process; and 3) the on-boarding process for new STATE employees, specific to 
mmunication, with an emphasis on the Secretaries of State. As part of that review, 
ent a questionnaire in late March 2015 to the former Secretaries of State Madeleine 
ALBRIGHT, Colin POWELL, Condoleezza RICE, and Hillary CLINTON along with current Secretary 
of State John KERRY. The questionnaire Ce asked them about their use of personal email for 
work purposes. ! 


On April 15, 2015 STATE IG sent out requests to a broad number of STATE-related persons, 
including former staff members and others who may have sent or received work-related emails to or from 
the personal email accounts of the former Secretaries of State. The request asked for p ils and 
any policy or training given related to the use of personal email for business purposes. had 
not yet received any email files from any of the staff members of the former Secretaries of State and was 
told that there would be no response to the request by the attomey of Bryan PAGLIANO, former 
information technology advisor for CLINTON. 


bIC 


CLINTON sent out an all-staff cable that personal email should not be used day-to-day for 
business purposes and that personal email is not secure, so do not use them for business purposes. To the 
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best o recollection, CLINTON sent that cable out in 2009. After CLINTON’s time as vg 


Secretary of State, there was also STATE guidance that if STATE employees had to use their personal — 
email for business purposes they should send a carbon copy (Cc) to their “.gov” work email as well. 


In August 2014, STATE Under Secretary for Management Patrick KENNEDY sent out a 
memorandum for STATE employees not to use personal email for business purposes, but it did not 
address whether personal servers may be used for business purposes. There was STATE guidance that all 
information/emails related to work should be on an “approved automated system,” but there was no Le 


known STATE guid he use of to conduct business. That will be an . b7C 
official "finding" by "— 


STATE IG. 


sui bini PAGLIANO's former boss while at STATE, and be 
PAGLIANO's former boss was unaware PAGLIANO set-up CLINTON’ s personal work server for her. Boe 
There were no on-boarding policies in place to prevent what happened related to CLINTON using a 
personal server. STATE 1G was unsure what, if any, site survey or systems security and maintenance 
checks were conducted prior to the installation of CLINTON’s server by PAGLIANO. STATE IG was 
also unsure if anyone else other than STATE employees knew of, ever saw, or had access to the server. 


- All of STATE’s top officials’ email records related to their “.gov” emails were being preserved, or 
“journaled,” no matter what. Most STATE employees, those not considered top officials, could create 
email records themselves using the SMART system. The onus was on the regular STATE employees to 
self-determine what a record is and if they didn't use the SMART system and they've double-deleted the 
email, it was more than likely not going to be preserved. 


Regarding STATE IG's review and interaction with KENNEDY| be met = à 
KENNEDY several times, and stated KENNEDY was never overly uncooperative and never did anything 
unusual with regards to his cooperation V NNEDY's tone and tenor were definitely not 
positive when dealing with STATE IG. Iso attended meetings with KENNEDY 1n the past 
that discussed general goals going forward for STATE with regards to STATE IG's review. 


review led her to interview STATE officials who worked the FOIA process from ps 
within the Bureau of Administration, Office of Information Programs and Services, which fell under 2 NE 
KENNEDY’s purview. Some FOIA officials have seen events and behaviors they did not like or that 
made them uncomfortable, to include KENNEDY’s attitude toward them and how they handled the FOIA 
process related to CLINTON. Additionally, there was a request from the FOIA officials to STATE 
employees that asked for any emails sent to or from personal email accounts related to the CLINTON 
FOIA request. Some STATE employees responded they had no emails that fit the request; despite the 
negative response, for some STATE employees, FOIA officials knew there were at least some emails that 
should have been included in their response because the FOIA officials had already reviewed those emails 
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from within the batch of 30,000 CLINTON-related emails. Despite knowing some STATE employees —— 7/4 
had not responded correctly, the FOIA officials had no recourse to compel a positive response. 

For the FOIA request related to the 30,000 CLINTON-related emails and the Congressional b6 
inquiry that requested Dengna Beng e reit baier E review EE were handled outside the normal b7C 






dled outside the normal chain of 
b5 per DOS 


chainofpeonlel | ese requests were he 


people. wth os 


: recommended the FBI talk nl Je more information on events discussed 
above and for names of other people the FBI would be interested in talking with regarding the same. bE 
b7C 
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(U/FOUO) OnMay25,2016| | Special Agent, United States Secret Service ES 
US), was interviewed by Federal Bureau of Investigation (FBI) Special Agents (SA) 
and S Also present for the interview was a Federal Law Enforcement 
Association (FLEOA) Attorney and USSS SA After being advised of the identity of the 
interviewing agents and the nature of the interview provided the following information: 
/ was assigned to the protective detail of WILLIAM CLINTON from ef 
t Because —!À formation technology (IT) skills, he was asked 


ts and troubleshoot IT issues at the Clinton Foundation. From e] to 
assisted the Clinton Foundation in a case related to theft of information on the 
Clinton Foundation information systems. 


2011 to assist with the be 


(umese)| les contacted by JUSTIN COOPER in Jan BIC 


security of an email server at the Clinton residence in Chappaqua, Ne 
physically or remotely access the server in the residence at Chappaqu 
hardware components of the server or software installed on the server onducted open source 
research relating to the security of email servers and Teese BRYAN PAGLIANO to recommend 






adding outbound IP filtering to the server. received PAGLIANO's name and contact 
information from COOPER was aware of no other information pertaining to the email server 
located in Chappaqua. 


(U//FOUO) Notes of the interview will be maintained in a FD340 envelope and filed with the 
captioned investigation. 
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On September 17, Dreem eegen States Ze 


NK of State E. Street NW, bé age ar 028; was interviewed by 
' A Te orepsic Examine 










provided the following “iformalion: 


The DoS email system uses a hub and spoke configuration. There are approximately 120,000 
mailboxes on the system, of which approximately 95,000 are for unique users. The other 25,000 
mailboxes are general mailboxes and aren’t assigned to a specific user. Approximately 35,000 mailboxes 
reside on the local hub and are administered by Information Resource Management (IRM). The 
remainder of the mailboxes reside on spokes within the system and are not controlled by IRM. Spoke 
mailboxes, such as those at overseas posts, are administered by the local Information Security Officer and 
backup procedures vary by site. 


Upon receiving the preservation request from the FBI, IRM preserved and thereafter exported the 
mailboxes for all of the individuals listed on the request whose mailboxes are on the IRM system. 





estimated that approximately 400 of the 900 accounts listed on the preservation request are s à 
active users on the IRM system, with the other accounts residing on spokes, POEMS, or are associated | 
with users who are no longer at DoS. Each exported mailbox includes all of the active mail folders as 
well as any items in the Recoverable Items storage area of Microsoft Exchange, which retains items for 90 
days after they are deleted by the user. The export does not include any files, or mailboxes, that may have 
been archived by the user to their local desktop. 

The IRM operating system is backed up and retained for approximately 30 days. However, the 
email database is not part of the backup. For email recovery, IRM uses Database Availability Groups 
(DAG) whereby five dynamic copies of each mailbox are maintained, at two sites, to allow the system to 
be quickly restored if the primary database fails. 
WE, that the exported mailboxes were unlikely to contain many emails from prior to E à 
2012. Prior to that time mailboxes were limited to 500MB of data and users were regularly required to 
NONE | xs b3 
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delete old emails, or to create Personal Storage Folders (.pst files), when they hit the storage limit. 
Between 2012 and 2013, the storage limits were increased to 5GB. 


IRM uses the State Messaging and Archival Retrieval Tool (SMART) to archive record emaiis. 
The system was implemented in phases between 2008 and 2010 and replaced CableXpress for archiving 
cables and record emails. Kl noted that communications sent to an embassy are referred to asa 
cable and emails sent to a person are record emails. SMART requires the users to identify an email as 
meeting the record standard and then selecting the appropriate SMART tags within Outlook while 
composing the email. The period of retention for a SMART record is dependent on the tags selected by 
the user. 












provided that S/ES-IRM, also commonly referred to as the POEMS system, does not 
use the SMAR] 
noli | further noted that records for senior officials are archived when they leave office. 
recommended contacting Deputy Assistant Secretary MARGERET (PEGGY) GRAFELD, 
Deputy Assistant Secretary for Global Information Services (A/GIS) for more information on this 
process. 


The Bureau of Intellig earch (INR) / $ — for administering the mailboxes on 


the top secret network at DoS. provided tha 
be able to provide further details on INR and the top secret mail svstem. 


++ 


ystem to archive email records. They are instead obligated to follow the ‘print and file’ 


telephone 20| | would 


b6 
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On September 21, 2015 el State 
Department of State (STATE), Office of Inspector General (OIG), Offi : Mad | -" 


N. Moore Street, Suite 8 lington, VA 22209, office telephone | fax 70 
email addres state.gov called the writer, Information Technology 
pecialist/Forensic Examiner (ITS/FE) ofthe Washington Field Office (WFO) 
Computer Analysis Response Team (CART). 


The writer aske to provide general information regarding a group of fifty (50). 
email messages of interest that were found b uring his review of the Microsoft 
Outlook Personal Sto ers (.pst files, or *mailboxes") for HUMA M. ABEDIN and 
CHERYL D. MILLS confirmed that the Federal Bureau of Investigation (FBI) 


'eceived a full copy of the two (2) mailboxes on a Lexar thumb drive provided by 
from STATE. | 


Loo that he performed a search across the email data for the words “Secret” 
and “ ' using a searc called “Perceptive Search” and that the search returned 
fifty documents of wa Lä that most of the search hits appeared within the 
metadata of Microsoft Word documents, which he identified as “Call Sheets,” or doc 

provided to the Secretary of State prior to attending briefings with foreign dng `) 
believed the search hits appeared within the metadata of the documents and not within the actual 


content of the documents. The identified documents were sent as attachments to emails. 
could not remember if there were also search hits within any email messages. 


elieved that the documents may have been generated from a classified system 
and that at some point they may have been moved to an unclassified system. However, he was 
unsure whether the “Secret” and “NOFORN” markings would have been generated automatically 
by the system that was used to create the documents. P pas that STATE had not yet 
determined how the documents would have been marked with regard to classification. 


. The writer requested QE the FBI with the fil Message- 
Digest algorithm 5 (MD5) hash values for the files identified by STATE. advised that 


STATE was in the process of moving the email data onto a stand-alone computer within a 
Sensitive Compartmented Information Facility (SCIF) and that he anticipated this would happen 
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Continuation of FD-302 of Telephone call with] | , On. 09/2 age 2 
toward the end of the week (on or around Sentember 25_2015)1 _ stated that he would 
i wi OIG, STATE, telephone 703- b6 
email @state.gov to obtain and provide the FBI with the MD5 hash PC 





6 identified files and that he would contact the writer when this process was complete. 


FD-302a (Rev. 10-6-95) 


ALL FBI INFORMATION CONTAINEC ne 
HEREIN IS UNCLASSIFIED 
DATE 10<12<2015 BY 327J85TS4 NSIZG FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 6/23/2016 

























item On June 23 2016 ER 
iewed by Federal. Bureau of SS 
Also present for the cal] was 
g advised of the identities of the interviewing agents and dx purpose of the interview, 
p eg the following information: 

(U/ ad no new information regarding the whereabouts of the laptop that b6 
was shipped h from Platte River Networks (PRN) to the Clinton Foundation in BIG 
April of 2014 was not sure who the mailroom manager for the Clinton Foundation was at 
that time but offered to contact the foundation to inquire about the shipment confirmed 
that the address of the Clinton Foundation was 1271 Avenue of the Americas, 42^ , New York, NY 
10020. 

(U/FOV6) Following her January 2016 interview rovided the FBI an email chain b6 
from April 2014 with the subject “RE: HRC emails.’ pi reviewed the email chain | SE 
call and could not ER access the email so the interviewing agent read the chain to 

pne refresh her memory, Upon hearing the content of the email, provided that 
she recalled having a discussion wit pn about remotely accessing the HILLAR Y CLINTON 
email archive via the internet Hows |. — [eould not recall if she actually accessed the email 
archive remotely thereafter. believed that she may have taken riotes about the process 
during the call and agreed to check her personal records for any relevant information. 
(U//FOUO9) A copy of the original interview notes and the referenced email are attached in a 1A 
envelope. | 
— ——-—————-—— —————— —— — ———ÀÉÜ"— b3 
b7E 
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b6 


oe a. a net Besch wt, D. 


Homeland Security Investigations (HSI Department of Homeland 
Security (DHS), Norfolk Virginia, (757) ne was interviewed at 
the Norfolk Federal Building. After being advised of the identity of 
the interviewing Agent and the nature of the interview, [ 1] 
provided the following information: 


b6 


was previously employed as an Agent at the Department of Ges 


State, Bureau of Diplomatic Security (DS), and assigned ormer 

Secretary of State Rice’s personal protection detail from until 

January 2009. In January 2009 he was reassigned to former Secreta : 

State Clinton's detail. served on Clinton's detail until p 
hen he left the Department of State. 


Clinton's tenure at State brought about significant changes to 
established security and diplomatic protocois owing to the dissimiiar 
management styles and attitudes between Rice and Clinton. 
claimed that his time on Clinton's detail was short and that he had no 
information to offer with regard to security violations or mishand 
of classified information on the part of Clinton or her staff. T 
advised his recollections were vague regarding his time on Clinton’s — 

etail and that he could not recall specific events with clarity. 
was aware that a Biackberry phone was kept in a desk drawer in 
Clinton's SCIF but could not say with any degree of certainty that the 


phone belonged to Clinton or that storing i 
security violation. provided the name.of 
a former ASAC on Clinton’s security ne | 7 ee May be ina 


position to provide additional insight. was not familiar with 
the current whereabouts of 


b3 
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| b6 
On November 6, 2015, Senior Special Agent, Gr 
"Office of Investigations, Office of the ] 3 | , United States Department of State 
(STATE), office telephone 704 Leet 20 email address 
| ate. gov called the writer, Information Technology Specialist/Forensic Examiner 
of the Washington Field Office (WFO) Federal Bureau of Investigation 
(FBI) Computer Analysis Response Team (CART). 
mm... that he located an email containing content from a “confidential cable” 

sent from a Microsoft “Hotmail” emai] account to the STATE email address for Huma Abedin Lë 

(AbedinH @state.gov) that could be found in the data contained within evidence item 1B26 BIC 

provided by STATE to the FBI on or around August 14, 2015. Evidence item 1B26 is further 

described as a white and grey Lexar | b drive labeled with a sticker containing the 

words "Dept of State 703-312-3856." stated that when the email was received in 2011, 

the information was classified and that it was supposed to be declassified in 2013 but that he did 

not know if that was the case and did not know the current classification of the document, 

On November 6, 201 LL on the writer an email containing information to assist 
in locating the identified email in the FBI data set in evidence item 1B26. A copy of the email is Eë 
included in a IA envelope. S 
| 
| b3 
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